feat: platform AI names behind Sign in with OTM (v0.3.0)

- OTM SSO: /api/auth/otm-sso verifies the control-plane ticket (vendored
  verifier), in-memory jti claim, mints an HMAC cookie (src/lib/session.ts);
  /api/auth/session + /api/auth/signout. No accounts, no DB.
- /api/ai-names: server-side call to the platform's metered gateway
  (ANTHROPIC_BASE_URL + per-app gateway token), 401 without a session,
  ~20 req/h per OTM account. Prompt/parser shared with the BYO-key path
  via src/lib/ai-prompt.ts.
- Finder: 'Sign in with OTM for AI names' link → 'AI names' toggle when
  signed in; own key still overrides.

Pairs with platform 0.116.0 (needsAnthropic + needsAuthSecret on names).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XStQKxPfEjrTvWo83KFCxG

README.md

@@ -60,6 +60,20 @@ straight back:
 `diversify()` caps each strategy at ~28% of the returned list. Without it the
 top 20 came back as eighteen coinages — scoring alone clumps badly.
 
+## AI names
+
+Sign in with a free OTM account (the link sits next to the generate button) and
+an **AI names** toggle appears: Claude-generated ideas are merged in ahead of the
+built-in list, checked for availability like everything else. The call goes
+`browser → /api/ai-names → OTM's metered Anthropic gateway → Anthropic`; the app
+holds a per-app gateway token, never a real Anthropic key, and the route refuses
+anonymous requests and caps each account at roughly 20 requests an hour. The
+platform's monthly AI cap is the backstop.
+
+Sign-in is OTM SSO: `/sso/authorize?aud=app:names` on the control plane hands
+back a 60-second single-use ticket to `/api/auth/otm-sso`, which mints a small
+HMAC-signed cookie (`names.session`). There are no user accounts in this app.
+
 ## Bring-your-own AI key
 
 Optional. `/settings` stores an Anthropic or Gemini key in `localStorage`
@@ -97,7 +111,10 @@ npm run typecheck
 npm run build
 ```
 
-No env vars are needed to run it. Tailwind is present **only** to style the
+No env vars are needed to run it. Sign-in and platform AI light up only when the
+platform injects `AUTH_SECRET`, `OTM_SSO_SECRET`, `ANTHROPIC_BASE_URL` and
+`ANTHROPIC_API_KEY`; without them `/api/auth/session` reports `platformAi:false`
+and the UI hides the feature. Tailwind is present **only** to style the
 shared `@otm/account-panel` widgets (the bottom-right feedback chat-pop) — the
 app's own UI is handwritten CSS, so `preflight` is off and the config scans
 `node_modules/@otm/account-panel/src`. The app is always dark, so `<html