fix(cli): exchange gateway token after agent auth

[michiosw]

Summary

• exchange the fresh agent-scoped login token into the real gateway token before calling /mcp/connect-session
• keep the existing one-shot agent auth fallback, but stop sending the raw OAuth access token to the hosted connect-session endpoint
• update the fallback test to cover both token exchange hops

Testing

• go test ./internal/run ./internal/auth
• go test ./...
• go vet ./...

Hosted verification

• deployed backend revision api-00280-tvw is serving image gcr.io/spaces-479912/api:e65aeeb0622efe1aefbb263e89e96f2f8d00c1e3
• live agent-scoped browser auth completed against app_8112a731-0d0f-4115-b46c-3cf55bfb73d0
• live POST /mcp/connect-session returned 200 OK with a hosted connect URL after the extra gateway token exchange

---

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.