feat: new auth flow, refactor state

[fa-sharp]

This PR introduces a more secure auth flow, and a major refactoring of internal state and storage syncing.

Auth

• OAuth login and refresh is now entirely handled by backend server, with added PKCE support on login
• Access and refresh tokens are encrypted by the backend and stored in an opaque auth token by the client
• Client requests the access token when needed, and holds it in memory (session storage). Refresh token is never exposed.

State and storage

• Refactored state into composable hooks
• Using Zustand for transaction form state / persistence
• Migrated from Plasmo to WXT for browser extension storage