feat(cli): auth scaffold — login/logout/auth status + config + backend client (cli#83)

[LukasWodka]

Summary

RFC-0001 (epic backend#830) — the CLI auth side, scaffolded ahead of the backend device-grant so it activates the moment backend#835 ships. Part of cli#83.

What's here

• internal/config — ~/.tracebloc/config.json store (mode 0600, atomic write): backend env + user token + active client. Fully functional + tested.
• internal/api — backend REST client:
  • CLIENT_ENV → {dev,stg,prod} base URL, kept in lock-step with the installer's _backend_url;
  • proxy + CA aware (honors HTTP(S)_PROXY / NO_PROXY + the system cert pool — RFC-0001 must work behind a corporate / TLS-inspecting proxy, backend#830 Q1);
  • the RFC 8628 device-flow methods (RequestDeviceCode + PollToken, with the authorization_pending / slow_down / expired_token / access_denied states). Tested via httptest.
• internal/cli — tracebloc login (device flow: print URL + code, poll, store the token), logout, auth status. client create/list/use are stubbed (that's cli#84 — they need the user token from login + provisioning backend#836).

Functional now vs pending #835

Piece	State
config store, env→URL, proxy/CA HTTP	works + tested now
login device-flow logic	written to spec; goes live when backend#835 ships (until then it reports the backend doesn't support browser sign-in yet)
logout, auth status	work now (operate on local config)
client create/list/use	stubs → cli#84

Test plan

• ✅ gofmt clean · go build ./... · go test ./... (all 8 packages) green.
• ✅ internal/config: save/load round-trip, 0600 mode, missing-file→empty, clear.
• ✅ internal/api: BaseURL / ResolveEnv mapping; RequestDeviceCode + PollToken (pending→slow_down→success, and denied) via httptest.
• ✅ tracebloc --help lists login / logout / auth / client.

Opening as a reviewable scaffold (not a draft) — the config + api are fully functional, and login degrades gracefully until backend#835. Reviewers can merge now or hold for #835.

🤖 Generated with Claude Code

[LukasWodka]

👋 Heads-up — Code review queue is at 33 / 30

Above the WIP limit. The team convention is to review existing PRs before opening new work.

Open PRs currently in Code review (oldest first):

• .github#57 — fix(fr-gate): pass items at or beyond the required stage · author: @aptracebloc · no reviewer assigned
• .github#60 — feat(security): public-repo PII gate (block customer names + secrets in PRs) · author: @LukasWodka · no reviewer assigned
• .github#61 — fix(wip-limit): avoid sort|head SIGPIPE failing the WIP check when queue >10 · author: @shujaatTracebloc · reviewer: @saadqbal
• averaging-service#117 — refactor(averaging): per-framework weight-handling seam (WS-B B1) · author: @divyasinghds · no reviewer assigned
• averaging-service#118 — feat(averaging): trainable-only keyed-dict weight format (WS-C feat(cli): client create --credential-file — write the credential for the installer (#84) #104) · author: @divyasinghds · no reviewer assigned
• averaging-service#119 — fix(averaging): exact federated GaussianNB merge — usable + correct (WS-B B2, cli: logout must call POST /auth/revoke to revoke the token server-side (RFC-0001 R2 / §7.5) #112) · author: @divyasinghds · no reviewer assigned
• backend#815 — chore(deps): bump cryptography from 47.0.0 to 48.0.1 · author: @dependabot · no reviewer assigned
• backend#829 — feat(#817): failure surfaces a reason end-to-end + stuck-run reaper (WS6 I3/I4/I5/I8) · author: @saadqbal · no reviewer assigned
• backend#833 — fix(deploy): graceful shutdown + Dockerfile hygiene; drop dead EC2 script · author: @LukasWodka · no reviewer assigned
• backend#840 — feat(rfc-0001): namespace-slug rule + validation command (#837) · author: @LukasWodka · no reviewer assigned

Pull from review before opening new work. (This is a nudge from the kanban WIP check, not a block.)