feat(auth): add branded OAuth callback pages

[sunshinexcode]

Summary

Adds a branded OAuth browser callback page for Agora CLI login success and error states. The page now renders region-aware branding: cn shows Shengwang copy/logo, while global, empty, or unknown regions default to Agora branding and do not include Shengwang content.

Type of change

• Bug fix (non-breaking)
• New feature (non-breaking, additive)
• Behavior change to an existing command (potentially user-visible)
• Breaking change (CLI flag, exit code, JSON shape, or error.code rename/removal)
• Documentation only
• CI / packaging / tooling
• Refactor (no behavior change)

Public-contract impact

• No public-contract impact.
• Adds or changes a JSON envelope shape — described below.
• Adds a new error.code — added to docs/error-codes.md.
• Renames or removes an error.code — flagged as breaking, included in CHANGELOG.
• Changes an exit code for an existing command — flagged as breaking.
• Adds or changes a CLI flag — documented in help text and (if user-facing) docs/automation.md.

No CLI flags, JSON envelope shapes, exit codes, or error.code values are changed.

Test plan

Added unit tests for OAuth callback page rendering, including global branding, China branding, fallback-to-global behavior, and error-page behavior.

• go test ./... passes locally.
• make lint passes locally (gofmt, golangci-lint, error-code coverage audit).
• New behavior is covered by a JSON-mode integration test in internal/cli/integration_test.go.
• Edge cases are covered by unit tests in internal/cli/app_test.go (where applicable).

Ran:

go test ./internal/cli -run 'TestOAuthCallback|TestWaitForOAuthCallback|TestOAuth'

Documentation

• CHANGELOG.md updated under ## Unreleased (Added / Changed / Deprecated / Removed / Fixed / Security).
• docs/automation.md updated for any user-facing JSON shape, env var, or flag change.
• docs/error-codes.md updated for any new error.code (or N/A).
• README.md updated if the command tree, install path, or quickstart changed.
• AGENTS.md updated if engineering or release process changed.

No documentation contract changes are required because this only updates the browser callback page UI.

Security checklist

• No credentials, App Certificates, tokens, or PII added to fixtures, logs, or test output.
• No new outbound network call without timeout / context cancellation.
• No new file written under user $HOME without 0o600 perms when it can contain credentials (e.g. session, config).
• No new unsafe import.

Additional notes

The global page references the official Agora logo URL in browser-rendered HTML. The CLI itself does not make an additional network request for that asset.