omp auth-gateway and broker

Runs the oh-my-pi (omp) forward-proxy gateway and its credential broker as
confined, auto-starting snap services. This keeps your LLM provider
credentials (OAuth refresh tokens and API keys) outside of the containers
in which you run omp itself.

Two daemons are installed and enabled automatically:
* gateway-daemon -> omp auth-gateway serve (forward proxy, default 127.0.0.1:4000)
* broker-daemon -> omp auth-broker serve (credential vault, default 127.0.0.1:8765)

Two wrapper commands are provided for ad-hoc management (login, token,
status, check, import, migrate, ...). The gateway command works out of the
box; expose the broker one with:
snap alias omp-auth-gateway.broker omp-auth-broker

Both the CLI wrappers and the daemons share a single root-owned vault, so sudo omp-auth-broker login anthropic adds credentials that the running
broker-daemon immediately serves.

Configuration (changes restart the affected services):
snap set omp-auth-gateway gateway.bind=0.0.0.0:4000
snap set omp-auth-gateway broker.bind=127.0.0.1:8765
snap set omp-auth-gateway gateway.broker-url=http://127.0.0.1:8765