feat: platform AI names behind Sign in with OTM (v0.3.0)

- OTM SSO: /api/auth/otm-sso verifies the control-plane ticket (vendored
  verifier), in-memory jti claim, mints an HMAC cookie (src/lib/session.ts);
  /api/auth/session + /api/auth/signout. No accounts, no DB.
- /api/ai-names: server-side call to the platform's metered gateway
  (ANTHROPIC_BASE_URL + per-app gateway token), 401 without a session,
  ~20 req/h per OTM account. Prompt/parser shared with the BYO-key path
  via src/lib/ai-prompt.ts.
- Finder: 'Sign in with OTM for AI names' link → 'AI names' toggle when
  signed in; own key still overrides.

Pairs with platform 0.116.0 (needsAnthropic + needsAuthSecret on names).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XStQKxPfEjrTvWo83KFCxG

src/app/globals.css

@@ -360,6 +360,30 @@ h2 {
   text-decoration: underline;
 }
 
+.signin {
+  font-size: 14px;
+  text-decoration: none;
+  white-space: nowrap;
+}
+
+.signin:hover {
+  text-decoration: underline;
+}
+
+.wrap button.linkish {
+  background: none;
+  border: none;
+  padding: 0;
+  font-size: 12px;
+  color: var(--faint);
+  text-decoration: underline;
+}
+
+.wrap button.linkish:hover:not(:disabled) {
+  color: var(--muted);
+  border-color: transparent;
+}
+
 /* ---------- notices ---------- */
 
 .notice {