feat(worker): Online Inbox sync engine (Phase 1)

Optional, opt-in (online_inbox.enabled, default false → zero network).
Worker-side reconcile loop: pull web-created tasks down as Idle, push the
list catalog and the Idle backlog mirror up. Auth behind IOnlineAuthProvider
(StaticTokenAuthProvider default; ZitadelAuthProvider stubbed for Phase 2).
DPAPI refresh-token store. 35 tests, no real network/Zitadel/Claude.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

tests/ClaudeDo.Worker.Tests/Online/OnlineTokenStoreTests.cs

@@ -0,0 +1,53 @@
+using ClaudeDo.Worker.Online;
+
+namespace ClaudeDo.Worker.Tests.Online;
+
+public sealed class OnlineTokenStoreTests : IDisposable
+{
+    private readonly string _tokenPath = Path.Combine(Path.GetTempPath(), $"online_token_{Guid.NewGuid():N}.bin");
+
+    public void Dispose()
+    {
+        try { File.Delete(_tokenPath); } catch { }
+    }
+
+    [Fact]
+    public void Save_Read_RoundTrips()
+    {
+        if (!OperatingSystem.IsWindows()) return; // DPAPI is Windows-only
+
+        var store = new OnlineTokenStore(_tokenPath);
+        store.Save("my-refresh-token");
+        var result = store.Read();
+        Assert.Equal("my-refresh-token", result);
+    }
+
+    [Fact]
+    public void Clear_Removes_Token()
+    {
+        if (!OperatingSystem.IsWindows()) return;
+
+        var store = new OnlineTokenStore(_tokenPath);
+        store.Save("token");
+        store.Clear();
+        Assert.Null(store.Read());
+    }
+
+    [Fact]
+    public void Read_WhenFileAbsent_Returns_Null()
+    {
+        if (!OperatingSystem.IsWindows()) return;
+
+        var store = new OnlineTokenStore(_tokenPath);
+        Assert.Null(store.Read());
+    }
+
+    [Fact]
+    public void Clear_WhenFileAbsent_DoesNotThrow()
+    {
+        if (!OperatingSystem.IsWindows()) return;
+
+        var store = new OnlineTokenStore(_tokenPath);
+        store.Clear(); // no exception expected
+    }
+}