OAuth is just a painful thing you need to get past. Once you figure it out you'll wonder what the fuss was all about.
I threw together a sample Windows Forms solution here. It's quick & dirty so go easy on me ;-)
You'll also need DevDefined.OAuth.dll which you can get the code for here.
Regarding Intuit, QBO, and desktop solutions: The app registration at Intuit doesn't know or care if your app is a desktop app. The only issue is if you want to be listed on their App Center. In that case you have to build a proper SaaS solution and go through Intuit's security review. For a single-user custom app, you can leave it in dev mode. Supposedly it's also possible to publish an unlisted mass-market app without going through all the formalities, but I haven't been through that process myself.
All new development for QB Online must use the QBO v3 REST API.
You do need some way to accept the callback from Intuit, but you only need a simple page that can grab the realmId and oauth_verifier from the query string and display them for the user. Let the user copy and paste these into the desktop app, which should save the securely. If you don't have a web site where you can do this, you can build one pretty cheaply (I'm partial to Windows Azure). I don't think it even needs to be secure - the verifier only works until it's used to get an access token, and you need the request token in order to use it.
See the discussion about how to process QBO API requests with DevDefined OAuth here: build a signature using devdefined
I haven't been as generous in these forums as many other people, but I see a lot of pain and confusion around OAuth and non-published apps, so I thought this might help a bit. I probably missed a few details so I hope others will add info as needed.