login: time out the browser sign-in wait after 5 minutes

The device flow is bounded by the AS's expires_in (capped at 15m), but the browser flow waited on the loopback redirect with no deadline — a closed tab left entire login hanging until Ctrl-C. Bound the wait at 5 minutes, starting after the Enter prompt so reading time isn't counted, and point the timeout error at --device as the escape hatch. Parent-context cancellation (Ctrl-C) still surfaces as cancellation, not as a timeout.