feat: custom-scheme login (mirrorstack://) — Phase A + B

[I-am-nothing]

Follow-up to #5. Make `mirrorstack://callback` the default redirect for `mirrorstack login`, with OOB as a fallback when scheme registration is unavailable.

Why

Better UX — triggers the native "Open in MirrorStack?" OS prompt the same way `zoommtg://`, `vscode://`, `jetbrains://` do. No copy-paste step.

Phase A — receive-side + Linux/Windows registration

• URL-handler subcommand: when the binary is launched with `mirrorstack mirrorstack://callback?code=...&state=...` (OS-spawned via the registered scheme), parse the URL and relay the code to the waiting `login` process.
• IPC: simplest path is a per-state file under `os.TempDir()`, mode 0600. `login` polls; the URL-handler writes.
• Linux auto-register on first `login`: drop `~/.local/share/applications/mirrorstack.desktop` with `MimeType=x-scheme-handler/mirrorstack=mirrorstack.desktop`, then `update-desktop-database`.
• Windows auto-register on first `login`: write `HKEY_CURRENT_USER\Software\Classes\mirrorstack` registry keys.
• macOS first `login`: print a one-time hint with the manual install command (Phase B replaces this).
• Default = `mirrorstack://`, fall back to OOB if scheme isn't registered (or fails to register).

Phase B — macOS .app bundle distribution

• Build pipeline produces a `MirrorStack.app` bundle whose `Info.plist` declares `CFBundleURLTypes` for `mirrorstack`.
• brew formula installs the bundle into `/Applications` (or `/usr/local/Caskroom`); a launcher symlink in `/usr/local/bin` keeps the `mirrorstack` command on PATH.
• CI publishes signed + notarized builds.

Acceptance

• On a fresh Linux box: `brew install mirrorstack && mirrorstack login` triggers the OS prompt; user clicks Open; CLI receives code via the registered handler; tokens saved.
• Same on macOS (after Phase B).
• Same on Windows.
• OOB fallback still works if registration fails (e.g., headless / SSH).

Out of scope

• Re-introducing loopback redirect (api-platform#107 removed it deliberately).