Add browser-based agent authorization flow

[chubes4]

Summary

OAuth-style consent flow for agents to obtain bearer tokens — no manual token copying needed.

The Flow

Agent                          Browser                    extrachill.com
─────                          ───────                    ──────────────
Opens authorize URL ──────────────────────────────────→  /datamachine/v1/agent/authorize
                                                          ?agent_slug=sarai
                                                          &redirect_uri=http://localhost:9999/callback

                               Not logged in? ──────────→ wp-login.php → back to authorize
                               
                               Consent screen:
                               "Sarai Chinwag wants access"
                               [Authorize] [Deny]
                               
                               User clicks Authorize ───→ Validates nonce + access
                                                          Mints bearer token
                                                          Redirects to callback?token=datamachine_sarai_...

Agent catches callback
Stores token locally
Done.

Security

• WordPress nonce CSRF protection on the form POST
• User must be logged in (redirects to wp-login if not)
• User must be agent owner or have admin access grant
• redirect_uri validated: only localhost, same-site, or domains registered via datamachine_authorize_allowed_domains filter

Files

• inc/Core/Auth/AgentAuthorize.php — new file, the full authorize flow (GET consent screen + POST handler)
• data-machine.php — wires up the new class alongside AgentAuthMiddleware

Testing

• Unauthenticated request → 302 to wp-login ✅
• Authenticated request → consent screen renders ✅
• Same pattern GitHub, Slack, and Stripe use for OAuth consent