Connect and disconnect a Bluesky identity with OAuth

[micahflee]

Parent

• Add full Bluesky platform support with mobile-compatible archives #672

What to build

A user can authorize a Bluesky identity through OAuth, refresh its DID-backed profile, and disconnect or reconnect without losing saved data.

Acceptance criteria

• Authorization uses Bluesky OAuth and direct AT Protocol APIs, never app passwords, scraping, interception, or MITM.
• Connection binds the authenticated DID and refreshes current profile data; handle changes do not change UUID or storage paths.
• Disconnect removes authorization but retains the local account and offline saved data.
• Connection material uses the credential facility from Protect all persisted account credentials from plaintext storage #671 and is excluded from Bluesky account data, Cyd Bluesky archives, and diagnostics.
• Linux clearly discloses the basic_text fallback when protected credential storage is unavailable.
• Controller and mounted-view tests cover success, failure, reconnect, handle change, disconnect, and offline access.

Blocked by

• Replace the dormant Bluesky model with isolated local accounts #673
• Protect all persisted account credentials from plaintext storage #671

(This was written by an LLM.)