Devboxes v0.2.0: browser login and terminal compatibility

[vicotrbb]

Summary

• add external-browser Authorization Code + PKCE login with strict numeric loopback callbacks, CSRF-protected approval, one-time hash-only codes, and scoped expiring CLI tokens
• vendor pinned Ghostty terminfo with attribution, validate incoming TERM values, and provide deterministic unknown-terminal fallback before tmux
• add unit, image, security, responsive UI, and clean-cluster lifecycle coverage; bump all release surfaces to v0.2.0

Security design

• fixed native client and response_type=code; PKCE S256 only
• high-entropy state/verifier, exact callback binding, and 10–900 second CLI timeout
• bounded/expiring authorization-code store with atomic single use and no plaintext code retention
• signed JWTs restricted by issuer, audience, type, scope, time, and maximum lifetime
• generic exchange errors and no-store/referrer protections; bearer values are never written to normal or JSON output
• master bearer compatibility remains available for existing automation

Validation

• make bootstrap
• make lint
• make test (58 controller tests, 14 CLI tests; 90.53% controller coverage)
• make helm
• make images
• npm, pip-audit, cargo-audit, gitleaks, and kubeconform clean
• responsive browser QA at desktop, 390x844, and 320x568
• DEVBOXES_E2E_CLI=cli/target/debug/devbox scripts/kind-e2e.sh: browser PKCE login, 0600 config, CLI lifecycle, Ghostty/unknown TERM, tmux reconnect, PVC/host-key reuse, and purge