fix(cli): real whoami auth, --json on provision verbs, headless login

[mastermanas805]

A dogfood pass found three agent-facing issues in the instant CLI. All three are fixed here in one PR.

B1 (High) — whoami false-positive authentication

Symptom: instant whoami --token <bogus> --json returned {"authenticated":true,"tier":"flag-token"} exit 0 for ANY non-empty token (and tier:"env-token" via INSTANT_TOKEN). cmd/whoami.go was a pure local-credential reflector that never validated against the server.

Fix: whoami now calls GET /auth/me (named const authMePath) and sets authenticated:true only when the server confirms the token; tier/email/team_name come from the /auth/me response. Offline handling: a transport failure reports authenticated:false with a distinct error note (exit 1, "could not reach the server…") so a flaky network never masquerades as logged-out; a server 401/403 → authenticated:false + exit 3 (session expired). No-token path is unchanged (clean anonymous, exit 0, no network). In --json mode stdout is a single JSON object; the human-readable reason goes to stderr (main.go), so whoami --json | jq .authenticated parses cleanly.

Symptom:        whoami --json reports authenticated:true for a bogus token
Enumeration:    rg -F 'flag-token' / 'env-token' / 'IsAuthenticated' in cmd/whoami.go (single reflector, 1 site)
Sites found:    1
Sites touched:  1   (cmd/whoami.go rewritten to validate via GET /auth/me)
Coverage test:  TestWhoami_BogusToken_ReportsNotAuthenticated (+ valid/offline/5xx/no-token/--token variants)
Live verified:  local mock /auth/me → bogus token: {"authenticated":false} exit 3; real token: {"authenticated":true,"tier":"pro"} exit 0

B2 (Medium) — provision verbs reject --json

Symptom: instant db new --name x --json → unknown flag: --json exit 1. The flag existed on resource/resources/whoami/status/etc. but NOT on the provision new verbs.

Fix: --json added to every provision new verb (db/cache/nosql/queue/storage/webhook/vector — all route through makeProvisionCmd). Success emits the full structured response (token, connection_url/receive_url, env + environment, tier, env_override_reason, note). Errors funnel through the shared JSON envelope (provisionJSON added to jsonModeOn).

Symptom:        `<verb> new --json` → unknown flag: --json
Enumeration:    rg -F 'makeProvisionCmd' — all 7 verbs share one builder; flag registered in 2 init blocks (monitor.go, extras.go)
Sites found:    7 verbs / 2 init sites
Sites touched:  7 / 2  (single emit path in makeProvisionCmd → emitProvisionJSON)
Coverage test:  TestProvision_JSON_AllVerbs (table over all 7) + error-envelope + env-override + omitted-env tests
Live verified:  local mock → `db new --json` emits {ok,token,connection_url,environment,...} exit 0

U2 (Medium) — login unusable on headless/agent boxes

Symptom: browserLauncherForGOOS hardcoded open/xdg-open/rundll32, ignored $BROWSER; on a headless box it printed "Could not open browser automatically" then blocked polling 5 min with no escape.

Fix: (a) $BROWSER (named const browserEnvVar) takes precedence over the per-GOOS default on every platform, treated as a bare command name (no shell parsing). (b) --no-browser flag prints the login URL + session id to stdout and continues polling without ever attempting to launch a browser — the most useful behavior for a supervising agent (URL is captured, login still completes hands-free if a human/agent opens it). Interactive happy path unchanged.

Symptom:        headless login spawns a useless browser + blocks 5 min silently
Enumeration:    rg -F 'browserLauncherForGOOS' / 'openBrowser' (login.go, 1 launcher site)
Sites found:    1 launcher + 1 login flow
Sites touched:  1 / 1
Coverage test:  TestBrowserLauncher_HonorsBROWSER (+ whitespace), TestLogin_NoBrowser_PrintsURLAndPolls
Live verified:  `login --help` shows --no-browser + $BROWSER note; flag prints URL+session and polls to completion

Gate

• make ci (build + vet + -race tests) green
• golangci-lint run → 0 issues
• 100%-patch coverage: every added line covered (verified by parsing the diff against origin/master + the cover profile; mirrors the CI diff-cover --fail-under=100 gate)
• Named consts (authMePath, browserEnvVar, defaultAPIBaseURL) — no scattered literals

🤖 Generated with Claude Code