Unified AMS/ORB Auth (GitHub App device flow)

Make loopover-mcp login (GitHub App device flow, already used for ORB's MCP session) also produce a usable GitHub token for AMS's git operations, so one login covers both. The App (Loopover ORB, ID 4139483) already has Contents/Pull requests/Issues/Checks/Workflows at Read & write — no re-consent migration needed. The gap is that the OAuth/device exchange discards the raw GitHub user-to-server token after using it once for identity verification; it is never persisted or returned to the CLI.