test: add unit tests for cli.ts core logic

[mforce]

Summary

cli.ts is the main entry point with zero test coverage for its core logic paths. Several of these are production-critical — the api_key/auth_token env branching already caused a 401 bug (#16).

Gaps to cover

High priority

• Env-var assembly (api_key vs auth_token branching) — controls whether ANTHROPIC_API_KEY or ANTHROPIC_AUTH_TOKEN is set when spawning claude. Incorrect branching leaks real API keys or causes auth failures.
• Config precedence chain — CLI flag > env var > config file > provider default. Verify each layer overrides the next correctly for provider, baseUrl, token, and model.
• custom provider validation — missing --base-url or --token should error with exit code 2.
• setup subcommand dispatch — process.argv[2] === "setup" should call runSetup() and exit before parseArgs.

Medium priority

• --list output — prints tab-separated model entries and exits.
• listForProvider dispatch — correct lister called per provider.
• CLAUDE_CODE_ATTRIBUTION_HEADER — defaults to "0" but honors caller override.

Lower priority

• providers.ts — port env-var overrides (LMSTUDIO_PORT, OLLAMA_PORT, LLAMACPP_PORT) are read lazily. All four provider entries have valid lister values.
• listers.ts — malformed ollama row (parts.length < 4) silently skipped.

Approach

Extract testable logic from cli.ts where possible (e.g., env assembly into a pure function) rather than testing through the full CLI binary. Use the existing cli.integration.test.ts pattern (subprocess with controlled env) for paths that require the full entry point.

Context

The api_key→auth_token fix for llamacpp (#16) is the kind of bug these tests would have caught. The env assembly is security-sensitive (controls whether a real Anthropic key gets sent to a local server).