Fix Windows sign-in: don't launch the browser through cmd.exe (v1.0.1)

cmd's `start` splits unquoted commands at "&", truncating the OAuth authorize
URL after the first query parameter — Windows users hit AADSTS900144 (missing
'scope'). Launch via rundll32 url.dll,FileProtocolHandler instead, which takes
the URL as a plain argument with no shell parsing.

Same fix as claude-msplanner b07a241, applied to the canonical skill copy and
synced into the extension bundle.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

mcp-extension/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ms-todo-mcp-extension",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "private": true,
   "type": "module",
   "description": "Microsoft To Do MCP server, packaged as a Claude Desktop .mcpb extension",