feat: /auth/cli-callback page + OAuth-first connect docs

Adds the manual-paste fallback page MCP clients hit when their OAuth
loopback callback isn't reachable (sealed containers, port-restricted
hosts). The page displays the authorization code, the full callback URL,
and the state parameter, all with copy buttons, plus instructions to
paste back into the waiting terminal. Single-use codes plus client-side
PKCE mean displaying the code here is safe — it isn't a credential by
itself.

README "Connecting Claude Code" rewritten to make OAuth the primary
path, with three options ordered by preference: (A) standard OAuth +
loopback, (B) manual paste via /auth/cli-callback, (C) static HMAC
bearer via /connect for fully headless setups. Also notes that the
zero-config plugin path is blocked on Authentik DCR (issue #8751,
expected later this year) so we're shipping the one-liner now.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/web/app/auth/cli-callback/copy-button.tsx

@@ -0,0 +1,29 @@
+"use client";
+
+import { useState } from "react";
+
+interface Props {
+  value: string;
+  label: string;
+}
+
+export default function CopyButton({ value, label }: Props) {
+  const [copied, setCopied] = useState(false);
+
+  async function copy() {
+    try {
+      await navigator.clipboard.writeText(value);
+      setCopied(true);
+      setTimeout(() => setCopied(false), 1500);
+    } catch {
+      // Fallback for old browsers / non-secure contexts: select the next
+      // <pre> and let the user hit ⌘C themselves.
+    }
+  }
+
+  return (
+    <button type="button" onClick={copy} style={{ marginBottom: "0.5rem" }}>
+      {copied ? "✓ Copied" : label}
+    </button>
+  );
+}