feat(worker): Online Inbox sync engine (Phase 1)

Optional, opt-in (online_inbox.enabled, default false → zero network).
Worker-side reconcile loop: pull web-created tasks down as Idle, push the
list catalog and the Idle backlog mirror up. Auth behind IOnlineAuthProvider
(StaticTokenAuthProvider default; ZitadelAuthProvider stubbed for Phase 2).
DPAPI refresh-token store. 35 tests, no real network/Zitadel/Claude.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/ClaudeDo.Worker/Online/StaticTokenAuthProvider.cs

@@ -0,0 +1,21 @@
+using ClaudeDo.Worker.Online.Interfaces;
+
+namespace ClaudeDo.Worker.Online;
+
+/// <summary>
+/// Simple <see cref="IOnlineAuthProvider"/> that returns a fixed token supplied at construction.
+/// Used as the default DI registration until <c>ZitadelAuthProvider</c> is wired (Phase 2).
+/// Also serves as the test double.
+/// </summary>
+public sealed class StaticTokenAuthProvider : IOnlineAuthProvider
+{
+    private readonly string? _token;
+
+    public StaticTokenAuthProvider(string? token = null)
+    {
+        _token = token;
+    }
+
+    public Task<string?> GetAccessTokenAsync(CancellationToken ct = default)
+        => Task.FromResult(_token);
+}