Fix Windows auth URL opener

[ishaanxgupta]

What changed

• Replaced the OpenCode login flow's shell-string browser opener with a guarded openUrl helper.
• The Windows path now uses rundll32.exe url.dll,FileProtocolHandler first, with a cmd /c start fallback.
• Auth now returns a clear failure if opening the browser fails instead of waiting for timeout.
• Fixed small TypeScript strictness issues so the package's declared validation commands pass on this checkout.

Why

On Windows, launching a long OAuth URL through shell start can be parsed as a local target or otherwise mishandled. This is the same class of issue fixed for the Codex and Amp plugins, where /supermemory-login can route users away from the intended browser OAuth page.