Merge branch 'main' into fix/pkce-flow-session-extend

Both sides extended the OAuth flow entry points: main threads a login hint
through GetOAuthFlow/NewOAuthFlow, this branch threads a sessionExtend flag.
The merged signatures carry both.

client/android/login.go keeps main's structure — the hint reaches the flow
through GetOAuthFlow rather than a loginHintSetter assertion, profile email
helpers live in client/mobile, and runOAuthFlow is the shared driver — with
this branch's sessionExtend plumbing and wrong-account retry layered on top.
The branch's runInteractiveFlow is dropped in favour of runOAuthFlow.

client/android/ssh_client.go is new from main and merged without conflict,
but calls NewOAuthFlow; SSH login is a fresh login, so it passes false.

management.pb.go regenerated with the pinned protoc-gen-go v1.26 from
generate.sh. The .proto merged cleanly: main's LazyState and proxy_embedded
are disjoint from this branch's SessionExtend field.

client/server/panic_windows.go

@@ -3,6 +3,7 @@
 package server
 
 import (
+	"errors"
 	"fmt"
 	"os"
 	"path"
@@ -69,7 +70,7 @@ func setStdHandle(f *os.File) error {
 	handle := f.Fd()
 	r0, _, e1 := setStdHandleFn.Call(stdErrorHandle, handle)
 	if r0 == 0 {
-		if e1 != nil {
+		if !errors.Is(e1, syscall.Errno(0)) {
 			return e1
 		}
 		return syscall.EINVAL

client/server/server_privileged_test.go

@@ -10,7 +10,7 @@ import (
 	"testing"
 	"time"
 
-	"github.com/golang/mock/gomock"
+	"go.uber.org/mock/gomock"
 	"github.com/stretchr/testify/require"
 	"go.opentelemetry.io/otel"