fix: quote OAuth URL for cmd.exe on Windows

cmd.exe interprets & as a command separator, truncating the authorize
URL at the first query parameter. Use windowsVerbatimArguments and /s
to pass the quoted URL through without shell mangling.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

src/oauth.ts

@@ -40,9 +40,10 @@ function openExternal(url: string, platform: NodeJS.Platform = process.platform,
       const child = launch('open', [url], { stdio, detached: true });
       child.unref();
     } else if (platform === 'win32') {
-      const child = launch('cmd', ['/c', 'start', '""', url], {
+      const child = launch('cmd', ['/s', '/c', `start "" "${url}"`], {
         stdio,
         detached: true,
+        windowsVerbatimArguments: true,
       });
       child.unref();
     } else {