fix: correct state destructuring and document headless mode

- Fix extractCodeFromInput destructuring: returns { code, state } not
  { code, extractedState }, so state validation was being bypassed
- Add --no-browser hint to CLI banner for discoverability
- Document --no-browser mode in README.md and CLAUDE.md
- Add test:oauth script to package.json
- Add OAuth test to run-all.cjs test suite

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

src/cli/accounts.js

@@ -248,7 +248,7 @@ async function addAccountNoBrowser(existingAccounts, rl) {
     const input = await rl.question('Paste the callback URL or authorization code: ');
 
     try {
-        const { code, extractedState } = extractCodeFromInput(input);
+        const { code, state: extractedState } = extractCodeFromInput(input);
 
         // Validate state if present
         if (extractedState && extractedState !== state) {
@@ -460,6 +460,7 @@ async function main() {
 
     console.log('╔════════════════════════════════════════╗');
     console.log('║   Antigravity Proxy Account Manager    ║');
+    console.log('║   Use --no-browser for headless mode   ║');
     console.log('╚════════════════════════════════════════╝');
 
     const rl = createRL();