fix: replace keytar with native keychain, fix CLI validation routing, add auto-reauth on 403

- Replace keytar native addon with cross-platform keychain using OS CLIs
  (macOS security, Linux secret-tool, Windows PasswordVault)
- Fix isCliValidation guard matching all tagged errors by checking against
  explicit set of @effect/cli ValidationError tags
- Strip --pretty and --env global flags before passing args to @effect/cli
- Fix ApplicationsListQuery to use Relay connection syntax (edges/node)
- Add --scope option to 'auth login' for requesting additional OAuth scopes
- Add --scope option to 'api' command with automatic 403 retry: decodes JWT,
  detects missing scopes, triggers auth flow, and retries the request
- Remove keytar from dependencies and build externals

Author: wcole1-godaddy

build.mjs

@@ -83,7 +83,6 @@ esbuild
 		external: [
 			// Exclude native modules from bundling
 			"*.node",
-			"keytar",
 			// TypeScript is a peer dependency and should not be bundled
 			"typescript",
 			// pino-pretty uses worker threads and must be external

package.json

@@ -58,7 +58,6 @@
 		"graphql-request": "^7.1.2",
 		"ink": "^5.2.0",
 		"ink-select-input": "^6.0.0",
-		"keytar": "^7.9.0",
 		"open": "^10.1.1",
 		"picomatch": "^4.0.3",
 		"pino": "^9.6.0",