Simplify Compose control-plane authentication (#38)

## Summary

`bb apps` previously exchanged the normal opaque bbidentity session for
a Compose-specific purpose token, then cached, refreshed, and retried
requests with that token. The new contract moves that exchange to public
ingress: while the request is paused, ingress sends the bbidentity
session to the authorizer and replaces it with a short-lived Compose JWT
before forwarding.

The CLI now sends `Authorization: BBIdentity <credential>` only to the
exact staging and production Compose control-plane hosts over HTTPS.
Redirects stay disabled, cookies and legacy identity headers are
omitted, and reflected credentials are redacted from errors. Apps
commands require an already-valid stored session in every mode;
otherwise they fail promptly with `auth_required` and direct the caller
to explicit `bb auth login`. Only the explicit auth command owns the
browser login flow. The old exchange, cache, refresh, and retry
machinery is removed.

The staging infrastructure still needs to be activated before this can
be smoke-tested end to end. Merging this PR also does not update an
installed `bb` binary: Berd ships the CLI through its normal pinned
release process.

### Related issue

N/A. This replaces auth work from the archived pre-OSS repository.

### Testing

- `cd bb-cli && source ./bin/activate-hermit && just check`
- `cd bb-cli && source ./bin/activate-hermit && just build-bb-release`

Author: nathan-thillairajah

bb-cli/Cargo.lock

@@ -19,7 +19,6 @@ anyhow = "1"
 builderbot-auth = { path = "../crates/builderbot-auth", features = ["blocking-client"] }
 clap = { version = "4.5", features = ["env"] }
 clap_complete = "4.5"
-fs2 = "0.4"
 pbjson = "0.9"
 pbjson-types = "0.9"
 prost = "0.14"

bb-cli/Cargo.toml

@@ -104,7 +104,7 @@ lint: fmt-check
   cargo clippy --locked --all-targets --all-features -- -D warnings
 
 test:
-  cargo test --locked
+  cargo test --locked --all-features
 
 package-smoke: build-sq
   ./sqbin/{{BIN_NAME}}.exoskeleton --version