Add headless OAuth flow for CLI/automation

[satyaog]

Add headless OAuth flow for CLI/automation

Supports obtaining refresh tokens without an interactive browser in the same process. When ?headless=true is used:

• /login returns JSON with login_url and token_url instead of redirecting. A client can open login_url in a browser for the user to sign in, then call token_url to receive the refresh token.
• /token can wait (via an asyncio event) until the browser leg completes, then return the same refresh token to the headless caller.

Headless sessions are identified by a JWT in the headless_session query parameter (signed with the server secret, 5‑minute expiry). An LRU-cached store keyed by that session coordinates the waiting request and the browser callback. Query params are preserved when redirecting to login (e.g. offline_token, redirect=token).