[cry] User CLI with OIDC auth + git credential helper (avoid manual PATs)

[rawkode]

Goal: humans should not mint PATs to push/pull. Provide a gh-style flow: authenticate once via OIDC, then a git credential helper supplies short-lived, auto-refreshed tokens to git transparently. PATs remain for CI / non-interactive automation (see #71 PAT layer).

Multi-CLI architecture (decision)

Split the binaries by audience:

• comtrya — server / admin / operator (serve, config generate+validate, reconcile). (today crates/cli + crates/server.)
• cry — the end-user client (auth + git helper, later: browse/clone conveniences). New crate, e.g. crates/cry.

cry scope (this issue)

• cry auth login — OIDC device-authorization flow (or local-callback): open browser, obtain a token from the comtrya server, cache it (OS keychain preferred; encrypted file fallback) with refresh.
• cry auth status / cry auth logout.
• cry auth setup-git [--host H] — register cry as a git credential helper for the host (git config --global credential.https://H.helper \"!cry git-credential\"), mirroring gh auth setup-git.
• cry git-credential <get|store|erase> — implement the git credential protocol: on get for our host, return username + password = the cached short-lived token (refreshing if expired); store/erase manage the cache. This is what git invokes during push/pull.

Server side (dependency)

• A device-authorization grant + short-lived token issuance endpoint the helper drives (extends the existing OIDC at crates/server/src/oidc.rs and the credential/token store — reuse the feat(git): support push with personal access tokens #71 PAT/credential persistence where it fits, but these are ephemeral, not user-minted).
• The git-http Basic-auth path (from the PAT graft) accepts these short-lived tokens as the Basic password too, so the helper just feeds them to git.

Dependencies / sequencing

• Builds on: PAT/credential backend (in flight on feat/git-pat-auth), OIDC (exists), and the unified /r/<repo> git URL ([git-http] Multiplex browse + git-clone under one /r/<repo> URL (drop /git/) #127).
• Larger feature; own spec → plan → build after push+PAT lands.

Open sub-decisions (non-blocking)

• Token storage: OS keychain vs encrypted file (default: keychain, file fallback).
• OIDC flow: device-authorization (best for headless/remote) vs loopback redirect (best for desktop). Likely support both.
• Whether cry also wraps clone/browse helpers (cry clone <repo>).