auth: OAuth device flows, refresh, and Copilot exchange (C5)

Implement the device-authorization flow for both dialects (GitHub `token`
direct-poll; Codex `codex` poll→authorization-code→PKCE exchange), refresh_token
grant, Copilot secondary token exchange, JWT exp parsing, Codex account-id
extraction, and pure credential-building/refresh predicates. Adds a Presenter
hook for rendering the device-code prompt. Exported from public.zig.

1 files changed, 16 insertions, 0 deletions

diff --git a/libpanto/src/public.zig b/libpanto/src/public.zig
index aa2f7e8..2c15f1e 100644
--- a/libpanto/src/public.zig
+++ b/libpanto/src/public.zig
@@ -93,6 +93,22 @@ pub const loadTokenSet = auth_mod.loadTokenSet;
 pub const saveTokenSet = auth_mod.saveTokenSet;
 pub const deleteTokenSet = auth_mod.deleteTokenSet;
 
+// OAuth device-flow mechanism: interactive login, refresh, exchange, and the
+// pure credential/JWT helpers the embedder's auth manager composes.
+pub const AuthError = auth_mod.AuthError;
+pub const Presenter = auth_mod.Presenter;
+pub const DeviceCodePrompt = auth_mod.DeviceCodePrompt;
+pub const OAuthTokens = auth_mod.OAuthTokens;
+pub const oauthLogin = auth_mod.login;
+pub const refreshTokens = auth_mod.refreshTokens;
+pub const runExchange = auth_mod.runExchange;
+pub const buildCredential = auth_mod.buildCredential;
+pub const tokensToTokenSet = auth_mod.tokensToTokenSet;
+pub const needsRefresh = auth_mod.needsRefresh;
+pub const needsExchange = auth_mod.needsExchange;
+pub const parseJwtExp = auth_mod.parseJwtExp;
+pub const extractAccountId = auth_mod.extractAccountId;
+
 /// Non-streaming HTTP helper over the process-global client, plus JSON
 /// path readers — the building blocks of the OAuth flows.
 pub const http = @import("http_helper.zig");