fix: support SSH callback ports in init

[skvark]

Summary

• expose the same browser OAuth options on init and login
• allow init --no-browser --port <port> to select a deterministic loopback callback for SSH forwarding
• strictly validate callback ports for both CLI and programmatic callers
• print forwarding guidance from the shared login flow
• document remote interactive authentication and CI token usage

Root cause

--no-browser only controls whether GitHits launches a browser. The OAuth callback server still listens on the loopback interface of the machine running the CLI. A browser on another computer therefore needs an SSH local forward, and init previously had no way to select the callback port before the flow started.

Implementation

Browser-launch and callback-port option registration, parsing, validation, typing, and instruction formatting are centralized in one module. Both commands use those options and continue through the existing shared loginFlow; init does not implement a separate authentication path.

This is an independent maintainer implementation of the behavior described in #229. No commits from the contributor branch were incorporated.

Validation

• bun test — 2,502 passed
• bun run typecheck
• bun run build
• bun run lint
• Biome formatting on all changed TypeScript files
• source CLI unauthenticated smoke
• built CLI unauthenticated smoke under Node
• built MCP registration smoke under Node

The default source CLI and MCP smoke suites passed their unauthenticated phases, then their authenticated live probes were rate-limited by the service (HTTP 429).