fix(auth): bound web authentication sessions

[humandebri]

Purpose

• Bound native Internet Identity browser sessions so authentication cannot wait indefinitely.
• Publish the exact runtime behavior used by KinicWiki 1.0.2 as a reproducible Swift package release.

Changes

• Add timeout, task-cancellation, and concurrent-attempt handling to ICInternetIdentityAuthenticator.
• Keep shared browser sessions as the production default while allowing explicit ephemeral test sessions.
• Add iOS callback, state, duplicate-query, and malformed-payload regression tests.
• Add macOS and iOS GitHub Actions checks and document the public authentication API.

Verification

• swift test — 14 tests passed.
• xcodebuild test on iOS 18.5 Simulator — 19 tests passed.
• Generic iOS Simulator build-for-testing succeeded.
• Reviewed exact callback matching, one-time state validation, single completion, timeout cancellation, and concurrent-attempt rejection.

Impact

• Source-compatible default behavior for existing callers.
• New public timeout error and optional authentication parameters.
• No change to the production default browser-session sharing behavior.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.