feat: add browser login and personal Canvas commands

[smackgg]

Summary

• add login, status, and logout with browser authorization and secure OS credential storage
• add provider-neutral personal Canvas create, get, apply, and upload commands
• add safe PPE request routing while keeping browser login on the production identity origin
• keep CLI credentials out of browser, updater, and other child-process environments

Scope boundary

This PR intentionally excludes LibTV adapters, canvas import, CanvasPlan orchestration, internal batch asset allocation, beta release plumbing, and all provider-specific import code.

Browser login reuses the existing Web query_ak / generate_ak APIs through the dedicated /cli/pippit-tool-login page. It does not add a new server-side authentication protocol.

Verification

• go test -count=1 ./...
• go vet ./...
• npm test
• targeted Go race tests for auth, common client, Canvas, auth/canvas commands, and updater
• CGO-disabled builds for Windows amd64, Linux amd64, and macOS arm64
• source and diff audit confirming no LibTV, CanvasPlan, import, or batch-allocation code

Rollout dependencies

• deploy the /cli/pippit-tool-login Web page before releasing this CLI version
• deploy the personal Canvas AK routes before enabling Canvas commands in each target environment