feat: standalone device-flow OAuth command

[eyablonowitz]

Add standalone device-flow OAuth command

The current OAuth flow starts with the MCP server, opens the default browser, and requires a localhost callback. This is awkward with corporate SSO, remote shells, background MCP clients, or authentication in another browser profile.

Could Zereight support a standalone device-flow command?

zereight-mcp-gitlab auth

Suggested flow:

1. Print a GitLab authorization URL and user code.
2. Let the user authenticate in any authenticated browser.
3. Poll until authorization completes.
4. Store the token using the existing OAuth token path.
5. Reuse and refresh it when the MCP server starts.

For self-managed GitLab, the command could accept --api-url and --client-id.

[fforster/gitlab-mcp](https://gitlab.com/fforster/gitlab-mcp) provides a similar workflow through gitlab-mcp auth.

This could complement the existing GITLAB_USE_OAUTH callback flow and simplify OAuth for SSO, headless, and background-client environments.

[zereight]

Thanks for the suggestion — this is a reasonable enhancement for SSO / headless / background-client setups.

No code change is required for current OAuth to keep working. Until a standalone auth / device-flow command exists, these workarounds usually cover the same need:

1. Personal Access Token — set GITLAB_PERSONAL_ACCESS_TOKEN (or --token)
2. External token script — if another tool already manages GitLab OAuth credentials:

   GITLAB_USE_OAUTH=true \
   GITLAB_OAUTH_TOKEN_SCRIPT="coder external-auth access-token gitlab"

   See OAuth setup — external token script.

Leaving this open as a backlog feature request. PRs welcome.