feat(cli): uniqent login via browser (device authorization)

[maxlibin]

CLI half of browser-based login. Consumes the registry endpoints in RiggdAI/uniqentai#feat/device-login (/api/v1/device/{start,poll}).

What

• packages/cli/src/device.ts → runDeviceLogin: POSTs /device/start, prints the code + opens the browser, polls /device/poll until approved (returns token) / expired / timeout. Fully dependency-injected (fetch/open/sleep).
• uniqent login (no --token) now runs the browser flow and stores the returned token. uniqent login --token <unq_live_…> still stores directly; logout unchanged.
• Headless-safe: the OS opener no-ops without a TTY, and login with no --token and no TTY fails fast with an actionable error (no 10-minute poll hang in CI).

Tests

55/55 Vitest, tsc clean. Covers: start→poll→approved stores token, expired, start-failure, timeout, headless-no-token error, and --token path. No real network/browser in tests (injected deps).

Notes

• Requires the registry endpoints deployed to uniqent.ai for the live flow.
• E2E verify (human): deploy registry → uniqent login → click Approve → token stored → uniqent publish works.

🤖 Generated with Claude Code