GitHub Copilot OAuth provider - device flow authentication + token lifecycle.

Auth flow:
1. Device flow -> user visits github.com/login/device, enters code
2. Poll until authorized -> receive OAuth token (`ghu_...`)
3. Exchange OAuth token for short-lived Copilot API token
   via `api.github.com/copilot_internal/v2/token`
4. Auto-refresh the API token before expiry

Token detection priority (same as Copilot CLI):
1. Persisted OAuth token in `~/.vis/github-copilot-auth.json`
2. `COPILOT_GITHUB_TOKEN` env var
3. `GH_TOKEN` env var
4. `GITHUB_TOKEN` env var
5. macOS Keychain (`copilot-cli` service) - if `security` CLI available

Works with both Individual and Business/Enterprise plans.
Enterprise users can pass `:enterprise-domain` for GHE.