fix(host): close Omnigent final-review gaps

[dgokeeffe]

What does this PR do?

Closes the final Omnigent/auth review gaps:

• keeps the app-SP client secret only in Flask process memory;
• brokers short-lived OAuth tokens on loopback;
• leaves only host in [omnigents-host];
• refreshes host and spawned-runner Apps-proxy credentials without persisting a static bearer;
• removes the exposed PAT/personal identifiers and all detected mojibake;
• adds a repeatable Playwright SSO recorder and deployed PTY evidence test.

The spawned-runner refresh hook depends on omnigent-ai/omnigent#2711.

Automated evidence

• make test: 459 passed, 1 skipped.
• Focused CoDA broker/host suite: 26 passed.
• Omnigent runner/host modules: 154 passed.
• Repository mojibake scan clean.
• Exposed PAT revoked (databricks tokens list --profile daveok returned []).

Deployed evidence

Deployed the exact stacked source to Lakemeter app coding-agents-02:

• URL: https://coding-agents-02-335310294452632.aws.databricksapps.com
• deployment: 01f1832c3f7f19ba8d35442f875a3007 (SUCCEEDED)
• Omnigent wheel: 0.6.0.dev0, commit 43e7fce4
• host connected as host_1e70327a2a96b0917d8c2c8ef45694e9

Playwright drove a real browser PTY and passed in 10.36s, proving:

• profile keys exactly ["host"];
• no client ID, client secret, or static token in the profile;
• no DATABRICKS_CLIENT_SECRET in terminal env;
• broker helper and narrow CLI wrapper both return live tokens;
• café Ελληνικά 日本語 😀 round-trips cleanly with no mojibake markers.

Command:

DATABRICKS_PROFILE=lakemeter \
CODA_APP_URL=https://coding-agents-02-335310294452632.aws.databricksapps.com \
uv run pytest tests/e2e/test_live_sp_token_broker.py -v -s

Remaining live blocker

A real Omnigent session was created before the runner-auth fix (conv_baf4e6a67ee0443aaf06c34812aa615a) and correctly exposed the missing child-runner proxy credential; that defect is now covered and fixed by the dependency change.

After redeploy, the CoDA host repeatedly connected successfully, but Omnigent's browser/API worker returned 404 host not found for that same live host. This is a server-side process/replica host-registry routing issue, so an Omnigent-launched post-fix agent turn is not yet claimed as passing. This PR should remain unmerged until that deployed server routing issue is resolved and the turn is rerun.