fix(electron): hand the OAuth token back over loopback, not the OS deep link

The sign-in page served by the loopback server only ever navigated to
cumora://auth#token=... and left the handoff to the OS. main.cjs already
had a POST /auth/token endpoint for exactly this — with nonce checking
and a same-origin guard — and its own comments described the page as
POSTing, but nothing ever called it.

Relying on the scheme is what broke dev sign-in: an unpackaged
'electron .' run registers its Electron.app bundle for cumora://, so a
stray npx Electron (this machine had 8 registrations, incl. old release/
builds and a mounted DMG) wins the scheme and swallows the token — the
browser hands the session to a stranger's window and the app that armed
the nonce never sees it.

POST first, same origin as the page, straight to the process that armed
the nonce. The deep link stays as the fallback for the only case POST
can't serve: the app quit while the browser was still on the provider.

Verified end-to-end on a real Google sign-in, plus: wrong nonce still
dropped, cross-origin POST still 403.