punch init onboarding wizard: LLM provider + MCP server setup

[humancto]

Problem

First-time users hit cryptic errors when API keys are missing or MCP auth is expired. No guided setup.

Proposed Solution

punch init should:

1. Detect available LLM providers and guide API key setup
2. Detect available MCP servers in the environment
3. Walk through OAuth flows for services that need it (Gmail, Calendar, etc.)
4. Test all connections before completing
5. Generate a working punch.toml with validated config

punch doctor should:

• Detect expired OAuth tokens with clear re-auth messages
• Test MCP server connections and report status
• Check for missing API keys with provider-specific guidance
• Surface actionable fixes, not raw errors