feat: add OAuth login by instance

[alex-mahabir-glean]

Summary

• Add /login <hostname-or-instance-id> OAuth login
• Use DCR and PKCE without requiring a static bearer token
• Normalize instance IDs to Glean backend hostnames
• Update the getting-started guide and authentication docs

Validation

• python3 -m unittest discover tests
• python3 -m pytest -q tests
• git diff --check

[rob-barker-glean]

Thanks @alex-mahabir-glean — this fixes an issue that causes problems on first run.

/login acme resolving to acme-be.glean.com is the headline. The -be convention is one of those things you only know if someone tells you. With DCR + PKCE alongside it, you can now go from a fresh clone to a live session without obtaining a token first.

Two things I appreciated: normalize_instance_host preserves full hostnames and URLs instead of assuming everything is a bare instance ID, so custom tenants and dev setups keep working — and it returns None on malformed input rather than guessing a plausible-looking wrong hostname. Tests and docs in the same PR as well. Thx