One-shot OAuth entry point for the mobile setup flow.

Creates a session and 302-redirects the browser straight to Hugging Face's authorize page, so the phone only has to open this single URL. The existing /oauth/callback finishes the job (exchange → store token → start relay).