Major OAuth architecture rework - delegate complexity to backend. Key changes: - Add CovesSession model for simplified sealed tokens - Add CovesAuthService for backend-delegated OAuth - Update OAuth config for private-use URI scheme (RFC 8252) - Add automatic token refresh on 401 responses - Remove atproto_oauth_flutter package (~14K lines) The backend now handles all OAuth complexity (DPoP, PKCE, token exchange) and returns opaque sealed tokens that the client simply stores and sends.