fix(auth): send local dev sign-in to the local server, not production (#41)

AuthScreen's OAuth start URL fell back to getServerOrigin(), which is
'' (relative, for the Vite proxy) in dev — so `|| 'https://api.cumora.ai'`
always won and every local sign-in ran against production instead of
the local server. Use getPairingServerOrigin(), which already resolves
to the local dev API target outside the browser context.

Co-authored-by: liyadong <liyadong@infini-ai.com>
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>