feat: Use Todoist OAuth for CLI login

[amix]

Context

The CLI login flow now asks Todoist for a Comms-audience token instead of using the legacy Comms OAuth endpoints.

What was changed

• Repointed dynamic client registration, authorize, and token exchange to Todoist OAuth.
• Added resource=comms, Todoist-compatible comma-separated scopes, and the restricted PKCE verifier alphabet.
• Replaced fine-grained legacy Comms scopes with the planned coarse comms:* scope families.
• Added request timeouts and refreshed OAuth provider tests.
• Updated the README login note for users with old Comms-issued tokens.

Out of scope

• Extracting the Todoist resource-indicator OAuth flow back into @doist/cli-core.
• Fixing the repo-wide local dependency mismatch between this checkout and installed @doist/cli-core / @doist/comms-sdk types.

Testing

• npm test -- src/lib/auth-provider.test.ts passed.
• npx oxlint src/lib/auth-provider.ts src/lib/auth-provider.test.ts src/commands/auth/auth.test.ts passed.
• npx oxfmt --check src/lib/auth-provider.ts src/lib/auth-provider.test.ts src/commands/auth/auth.test.ts README.md passed.
• doistbot review staged ran once; concrete Todoist protocol findings were applied.
• npm test -- src/commands/auth/auth.test.ts fails in this checkout because @doist/cli-core/testing does not export captureConsole.
• npm run type-check fails in this checkout from the same baseline mismatch plus SDK type drift (@doist/cli-core account/testing exports, @doist/comms-sdk attachment/includeRemoved types, and existing activeBundle/activeAccount type errors).