Add dev webOS auth probe with profile-scoped access-token persistence

[Staphylococcus]

Parent: #20

Phase: 1.1.x groundwork, no production adapter switch.

Delivery relationship:
#47 and #48 are one authenticated-client foundation stream. They may land across several small PRs, but neither issue is a hard prerequisite boundary for the other. Complete and verify one slice before starting the next.

Delivery sequence:

• D1: profile-scoped token persistence
• D2: pure registration protocol model
• D3: correlated websocket client with test-local scripted server
• D4: authenticated client composition for stored-token and first-pairing paths
• D5: one typed read-only state call
• D6: temporary lg-buddy dev webos-auth-probe wiring
• D7: real-TV first-run pairing and second-run token reuse acceptance

Each code slice must pass its focused tests, cargo test -p lg-buddy, and clippy before the next slice starts. Do not begin #49 until D7 passes on real hardware.

Goal:
Create a temporary dev-only path that can idempotently acquire, store, and reuse the configured TV profile's platform access token for LG webOS, then prove the authenticated client with the smallest safe read-only webOS call.

This is the first useful direct webOS slice because registration and pairing are prerequisites for every later native operation. Normal LG Buddy runtime behavior must remain on the existing Python/bscpylgtv path.

Scope:

• Add internal web_os or webos module pieces needed by lg-buddy dev webos-auth-probe.
• Keep the dev namespace temporary; do not introduce or advertise a stable lg-buddy webos ... CLI surface.
• Resolve the active configured TV profile, currently primary, plus the config owner that should own credential material.
• Store the profile credential at a profile-scoped path such as ~/.config/lg-buddy/tvs/primary/access-token.json.
• Treat tvs/primary as the credential identity; platform mapping belongs in config, for example tvs_primary_platform=lg_webos.
• Implement PlatformAccessTokenStore for token path creation, retrieval, persistence, ownership, permissions, and a load-or-acquire operation.
• Keep registration as a subset of WebOsClient; registration builds the webOS payload, handles the pairing prompt path, correlates registration responses, and converts the TV's client-key response into a PlatformAccessToken.
• Make token acquisition transparent to probe/runtime consumers. Callers should request an authenticated WebOsClient, not manually load, register, persist, and retry.
• Have the token store be the sole caller of the webOS registration path for token acquisition.
• Register with an existing access token when present.
• Pair through the normal TV prompt when no access token exists, and persist the returned token only after registration succeeds.
• Send one safe read-only request, such as power state or foreground app/input, only to prove the authenticated client.
• Preserve request IDs and match responses by ID.
• Return structured errors for connection failure, token read/write failure, pairing required/rejected, timeout, malformed response, and webOS error payloads.

Acceptance criteria:

• The default runtime still uses the bscpylgtv adapter through BscpylgtvCommandClient.
• No installer, configure, README, user-guide, or normal command behavior changes are required.
• A first run can pair with the TV, persist the access token as the config owner with credential-safe permissions, and complete one read-only probe.
• A later run reuses the stored access token without prompting the TV again.
• The probe path constructs or receives an authenticated WebOsClient; it does not inline token load/register/persist branching.
• Token path creation, token retrieval, token persistence, token acquisition, and token creation from a webOS registration response are covered by focused tests.
• Existing .aiopylgtv.sqlite auth remains untouched.
• The implementation does not introduce a global native backend switch or a user-facing adapter platform.

Out of scope:

• Replacing the Python adapter.
• Runtime adapter selection.
• Multi-TV profile selection.
• Stable public webOS CLI commands.
• Installer or configure integration.
• Automatic migration from .aiopylgtv.sqlite.
• Implementing TvClient for direct webOS.
• Input, screen, power-off, or brightness parity beyond the one read-only auth proof.
• A reusable mock webOS websocket server beyond minimal local test support.