feat: add persistent OAuth token cache and session APIs (#4182)

Stacked on #4173 (diff includes it until that merges; will rebase
after). Addresses the token-cache part of [Colin's
review](https://github.com/lancedb/lancedb/pull/4173#issuecomment-5674048100).

Adds an explicit, opt-in persistent OAuth token cache shared by Rust,
Python, and Node clients, plus `login` / `status` / `logout` session
APIs, so short-lived processes (CLIs, scripts, notebooks) reuse one
session instead of restarting a browser or device flow on every start.

- **Opt-in and minimal**: existing callers stay memory-only and lazy.
Only refresh tokens are persisted (never access tokens, never client
secrets), so there are no local token-expiry decisions to get wrong when
clocks move. Each process start performs one silent refresh grant.
- **Hardened file backend**: private directory (`0700`), per-record
files (`0600`), owner validation, symlink rejection, and atomic `rename`
replacement. Corrupt, truncated, unknown-version, or permission-invalid
records fail with actionable errors naming the file. Native keyring
backends were evaluated (keyring crate routes Linux through D-Bus/zbus:
heavy deps, headless/CI flakiness) and are deferred; the file store is
the explicit opt-in, not a downgrade from a keyring.
- **Cache key**: SHA-256 of the canonical identity (issuer, client ID,
sorted/de-duplicated scopes, flow, public/confidential), so no secret
appears in a filename and distinct identities never collide. Versioned
record schema (`version: 1`). One record per identity: last login wins,
documented.
- **Cross-process rotation locking**: per-key `fs4` file lock (`flock` /
`LockFileEx`) around the refresh critical section — acquire, reread the
durable record, refresh exactly once, atomically store the rotated
refresh token, release. The OS releases locks on process death, so
crashes cannot strand stale locks. Only confirmed
`invalid_grant`/`invalid_token` deletes a record and reauthenticates;
transport, 5xx, 429, and parse failures retain it.
- **Session APIs**: `OAuthSession::login/status/logout` in Rust,
`lancedb.remote.OAuthSession` (async) in Python, `OAuthSession` class in
Node. `status` returns non-secret metadata only. `logout` removes only
the local credential — provider revocation (RFC 7009) is a deliberate
follow-up, and local logout never terminates browser SSO. Azure managed
identity is rejected for persistence (machine identity stays in memory);
client credentials have nothing refreshable to persist and stay
memory-only.
- No CLI binary exists in this repo, so this ships library APIs plus doc
examples in all three languages.

Tests: Rust unit + mock-IdP integration (cache-key
canonicalization/separation, record
versioning/corruption/truncation/symlink/owner/perms, lock serialization
+ release, two concurrent providers proving no `invalid_grant` and
correct rotation, transient-failure retention, `invalid_grant` delete +
reauthenticate, login/status/logout lifecycle, client-credentials no-op,
IMDS rejection, secret redaction); Python lifecycle + a true
two-subprocess cross-process reuse test (second process refreshes once,
never hits the device endpoint); Node lifecycle + device-flow login
test. Local builds were skipped in development; CI validates all
bindings.

---------

Co-authored-by: Xuanwo <github@xuanwo.io>

docs/src/js/interfaces/OAuthConfig.md

@@ -35,8 +35,32 @@ const config: OAuthConfig = {
 };
 ```
 
+The authorization URL is written to stderr before LanceDB tries to open a
+browser, so it can be copied in headless environments.
+```typescript
+const config: OAuthConfig = {
+  issuerUrl: "https://login.microsoftonline.com/{tenant}/v2.0",
+  clientId: "app-id",
+  scopes: ["openid", "api://lancedb-api/access"],
+  flow: OAuthFlowType.AuthorizationCode,
+};
+```
+
+Device Authorization writes the verification URL and user code to stderr
+before polling begins.
+
 ## Properties
 
+### callbackPort?
+
+```ts
+optional callbackPort: number;
+```
+
+Port for the AuthorizationCode loopback callback server (default: 8400).
+
+***
+
 ### clientId
 
 ```ts
@@ -88,6 +112,16 @@ Client ID for user-assigned managed identity (AzureManagedIdentity).
 
 ***
 
+### redirectUri?
+
+```ts
+optional redirectUri: string;
+```
+
+Loopback redirect URI for AuthorizationCode.
+
+***
+
 ### refreshBufferSecs?
 
 ```ts
@@ -109,3 +143,26 @@ scopes: string[];
 OAuth scopes to request.
 For Azure managed identity, exactly one scope or resource is required.
 For example: `["api://{app_id}/.default"]`
+
+***
+
+### tokenCache?
+
+```ts
+optional tokenCache: TokenCacheOptions;
+```
+
+Opt in to the persistent token cache so short-lived processes reuse one
+session. Only refresh tokens are persisted. Only supported by
+AuthorizationCode and DeviceCode; Azure managed identity is rejected.
+Default: unset (memory only).
+
+***
+
+### usePkce?
+
+```ts
+optional usePkce: boolean;
+```
+
+Protect AuthorizationCode with S256 PKCE (default: true).