feat: zerion login and logout commands (PKCE browser flow)

[graysonhyc]

Summary

Adds zerion login / zerion logout and routes zerion init through the new browser PKCE flow — users no longer have to copy an API key from the dashboard by hand.

• login (default) — opens dashboard.zerion.io/cli-auth with a PKCE code_challenge, polls a backend status endpoint, and auto-saves the returned API key. Interactive picker offers browser-PKCE or paste-a-key.
• login --api-key <key> — non-interactive save (for scripts / CI).
• logout — clears saved apiKey and any agentTokens, warns if ZERION_API_KEY is still set in the shell.
• init — now uses browserLogin() directly instead of prompting for a paste. --browser flag dropped (browser is the only interactive path); --yes skips auth and points users at zerion login for later.
• Inline offer — after wallet create / wallet import, if no API key is configured, the CLI offers to run login inline. Failures don't kill the wallet flow.

What's in the PR

• cli/utils/auth/pkce.js — session ID (32B hex), verifier (32B base64url), SHA-256 challenge.
• cli/utils/auth/browser-flow.js — opens WEB_URL/cli-auth?code_challenge=…#session_id=…, polls CLI_STATUS_URL every 2s (5-min timeout). 202 = pending, 401 = rejected, 200 { apiKey } = done. Accepts an opener for tests.
• cli/commands/login.js — banner, welcome menu, success block with team/API/masked key/config path. Reusable from inline flows via quiet: true (rethrows instead of process.exit).
• cli/commands/logout.js — single-path cleanup via unsetConfigValue, env-var hint.
• cli/commands/init.js — now calls browserLogin(); dropped local openBrowser() / readSecret() paste path and --browser flag.
• cli/utils/wallet/offer-login.js — post-wallet-setup login offer; suppresses banner on chained inline flows; survives login failure so wallet setup still completes.
• cli/commands/wallet/create.js, cli/commands/wallet/import.js — wired into the offer.
• cli/utils/common/constants.js — WEB_URL and CLI_STATUS_URL, both env-overridable for staging/tests.
• cli/router.js, cli/zerion.js — help output + command registration.
• README.md — new auth section leading with zerion login; copy-paste flow demoted to the non-interactive fallback (--api-key / ZERION_API_KEY). Setup table now lists login / logout. Quickstart simplified to npx -y zerion-cli init (no --browser).
• skills/zerion/SKILL.md — auth section now leads with zerion login / logout; env-var path is the non-interactive fallback for CI/headless agents.
• package.json — adds open dependency.
• package-lock.json — regenerated with optional deps so npm ci is happy in CI.
• tests/auth/{pkce,browser-flow}.test.mjs — PKCE fixture hash + mocked polling (202→200 and 401 rejection paths). Browser flow accepts injected opener so tests don't launch real browser tabs.

Edge cases handled

• Key format — validator accepts both zk_… (real dashboard format, e.g. zk_dev_… / zk_prod_…) and legacy zk-…. Previously rejected valid keys.
• Non-TTY stdin — interactive login and init detect !process.stdin.isTTY and surface a structured error/skip pointing at --api-key / ZERION_API_KEY instead of hanging on readline.
• Masked input — manual-paste path uses readSecret({mask: true}) so the API key no longer echoes into terminal scrollback.
• Flag collision — --api-key alongside --browser prints a note that --api-key wins.
• Env-var persistence — logout prints a hint to unset ZERION_API_KEY when the env var is still set, since it overrides the saved config.
• Already logged in — prints a masked preview and exits unless --force is passed.
• Inline login failure — when login is invoked from within wallet create / import, a failed PKCE flow (timeout, network) does not abort wallet setup; the outer flow continues and the user can retry login later.
• Banner suppression on chained flows — inline login skips the welcome banner so the wallet-setup output stays clean.
• Test isolation — browserLogin() accepts an opener arg, so unit tests don't spawn real browser tabs in CI.

Out of scope

No changes to x402, MPP, Solana support, analytics commands, auth.js, client.js, or any other existing code paths. This PR only adds the login/logout surface, routes init through it, and updates docs.

Test plan

• npm test — 101 unit tests pass, 0 fail
• npm ci succeeds locally (lockfile in sync; CI green)
• zerion login interactive picker (option 1 → browser PKCE, option 2 → masked paste)
• zerion login --api-key zk_dev_… non-interactive
• zerion login on already-logged-in config → exits cleanly, suggests --force
• zerion init (no flags) → routes through browser PKCE
• zerion init -y → skips auth with non_interactive reason
• zerion init with ZERION_API_KEY set → already-authenticated path
• zerion logout with and without ZERION_API_KEY set in shell
• zerion wallet create / import with no API key → offers inline login; failure doesn't abort wallet setup
• End-to-end against staging dashboard (requires backend /api/cli/status endpoint)

🤖 Generated with Claude Code