Discover Masko CLI browser authorization

The registered masko-cli client opens authorization_endpoint with response_type=code, client_id=masko-cli, device_name, scope read/write, redirect_uri, state, code_challenge, and code_challenge_method=S256. Only http://127.0.0.1:PORT/oauth/callback with port 1024..65535 is accepted. Use independent random verifier and state values with at least 32 random bytes; state is echoed and must be checked by the CLI. Browser sign-in and explicit workspace approval return a one-time code, never access or refresh tokens. This is Masko JSON transport, not general OAuth server discovery.