fetch authorize: discover the authorization_endpoint and run the person-token leg

[dickhardt]

Two gaps in the authorize subcommand, both hit live 2026-08-14:

1. It POSTs the r3_operations body to the URL the user passed (handlers.ts ~line 395) instead of discovering authorization_endpoint from the resource's .well-known/aauth-resource.json. Passing a bare origin 404s.
2. It signs with the agent token only and treats the 401 person_token_required challenge as fatal — the adaptive person-token acquisition lives only in the main command path. /authorize requires a person token (AAuth -11 §authorization-endpoint-request), so the subcommand fails against any conforming resource.

🤖 Generated with Claude Code

https://claude.ai/code/session_01TQ2FCHHAnuJWF5TJB3838S