fix: honour MOBILERUN_OAUTH_MANUAL across OAuth providers (part of #396)

[8crsk]

Part of #396.

While working out what's left of the droidrun to mobilerun rename I found one
user-facing environment variable that got missed. It's a functional gap rather
than a cosmetic one.

The gap

The rename gave every user-facing env var a MOBILERUN_* spelling, keeping the
legacy DROIDRUN_* name as a fallback:

Variable	MOBILERUN_* supported?
MOBILERUN_CONFIG	yes, with a DeprecationWarning for the old name
MOBILERUN_TELEMETRY_ENABLED	yes
MOBILERUN_STREAM_SCREENSHOTS	yes, 3 call sites
OAUTH_MANUAL	no, DROIDRUN_OAUTH_MANUAL only

OAUTH_MANUAL is read in all three OAuth login paths and each one only checked
DROIDRUN_OAUTH_MANUAL. Anyone setting MOBILERUN_OAUTH_MANUAL, which is the
spelling consistent with every other documented variable, silently got the
interactive browser flow instead. On a headless box that
_is_headless_environment() doesn't catch, there was no working way to force the
copy/paste login.

What this changes

• Reads MOBILERUN_OAUTH_MANUAL first and falls back to DROIDRUN_OAUTH_MANUAL,
  matching the pattern in ConfigLoader.load and is_telemetry_enabled.
• Documents the variable in docs/sdk/configuration.mdx. It wasn't documented
  under either name.
• Fixes the telemetry docstrings and the user-facing "telemetry disabled" message,
  which still told people to set DROIDRUN_TELEMETRY_ENABLED even though the code
  prefers MOBILERUN_TELEMETRY_ENABLED and the docs already use the new name.

What I deliberately didn't rename

#396 reads like it could be a repo-wide find and replace, but a mechanical rename
would break existing installs. These droidrun references look load-bearing to
me, so I left them alone:

• compat/droidrun/, the intentional backwards-compat shim package.
• ~/.droidrun/user_id and the "droidrun" platformdirs app name. That's on-disk
  state, so renaming it orphans every existing user's config file and resets their
  anonymous telemetry id. Feels like it wants a migration step rather than a
  rename.
• The droidrun.* OpenTelemetry span and attribute names
  (droidrun.screenshot, droidrun.vision.enabled, droidrun_version), since
  that's wire format already being consumed by existing dashboards.
• github.com/droidrun/mobilerun URLs, because the org is still droidrun.

Happy to do the on-disk config and telemetry migration as a separate PR if you
want it. It needs a real migration path so it seemed worth keeping out of this
one.

Tests

tests/test_oauth_manual_env_var.py, 45 cases across all three providers: both
spellings, precedence when both are set, and falsy or unset values. I checked they
fail (18 failures) with the source change reverted.

Full suite: 643 passed, with the same 4 pre-existing Windows encoding failures
that occur on a clean main. ruff, black and bandit are clean.