fix(word-addin): keep OAuth tokens out of localStorage in the dialog

WHY THIS MATTERS
The Google OAuth dialog created a Supabase client with
persistSession + storage: window.localStorage. After the PKCE code
exchange, the user's full session - access AND refresh token - was
written to localStorage on the add-in's origin. The cleanup that
removed it ran only on the happy path, and even then the client's
auto-refresh timer stayed alive and could re-persist the session
after the key was deleted. Any crash or close between the exchange
and cleanup left long-lived credentials on disk, readable by any
script on the origin. This contradicts the invariant the add-in
itself enforces elsewhere: tokens live exclusively in
OfficeRuntime.storage, never browser storage (office-mock.ts fails
tests that violate it).

WHAT IS THE PKCE PERSISTENCE ACTUALLY FOR
The dialog's Supabase client needs persistence for exactly one thing:
the PKCE code verifier must survive the same-tab redirect to Google
and back. That is a session-scoped, single-tab lifetime -
sessionStorage's exact semantics. Nothing about the flow needs the
minted session itself to be persisted at all.

HOW THE FIX WORKS
- storage: window.sessionStorage (+ autoRefreshToken: false), so
  nothing outlives the dialog window even on a crash.
- After a successful exchange the dialog signs the temporary client
  out with scope "local" - clearing its persisted copy and refresh
  timer without revoking the session the task pane is adopting -
  before handing the tokens over.
- clearTemporaryAuthStorage also sweeps the old localStorage keys so
  sessions persisted by earlier builds are removed.
- messageParent is now guarded: if the host rejects the
  DialogOrigin-1.1 messageOptions overload it retries the legacy
  same-domain form, and on total failure it shows an actionable
  message instead of claiming "Signed in" while the task pane hangs.
  The success status is only shown after the handoff call returns.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RuPCULDYgVsiCanRgbEy6W