feat(worker): Online Inbox sync engine (Phase 1)

Optional, opt-in (online_inbox.enabled, default false → zero network).
Worker-side reconcile loop: pull web-created tasks down as Idle, push the
list catalog and the Idle backlog mirror up. Auth behind IOnlineAuthProvider
(StaticTokenAuthProvider default; ZitadelAuthProvider stubbed for Phase 2).
DPAPI refresh-token store. 35 tests, no real network/Zitadel/Claude.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/ClaudeDo.Worker/Online/IOnlineInboxApi.cs

@@ -0,0 +1,9 @@
+namespace ClaudeDo.Worker.Online;
+
+public interface IOnlineInboxApi
+{
+    Task PutListsAsync(IReadOnlyList<RemoteList> lists, CancellationToken ct = default);
+    Task<IReadOnlyList<RemoteTask>> GetUnimportedTasksAsync(CancellationToken ct = default);
+    Task MarkImportedAsync(string id, CancellationToken ct = default);
+    Task PutMirrorAsync(IReadOnlyList<MirrorTask> tasks, CancellationToken ct = default);
+}