Add canonical settings and terms commands

[skvark]

Summary

• add canonical githits settings plus typed show, get, set <key> <values...>, and clear <key> commands
• validate a whitelisted settings schema and map friendly values such as marketing-emails disabled to canonical account API fields
• keep every mutation selective: one setting and one PATCH, with explicit empty/null behavior through clear
• add settings terms / settings terms accept, accepting either OAuth JWTs or opaque ghi-* credentials
• refresh stored OAuth sessions after acceptance; never attempt to refresh opaque API tokens
• classify REST and GraphQL TERMS_ACCEPTANCE_REQUIRED responses once in shared transport code, refresh/retry OAuth once, and return one shared CLI/MCP remediation with separate legal and environment-specific browser-acceptance URLs
• retain account-service diagnostics without advertising the development override in the public README

No settings mutation was added as an MCP tool or public @githits/mcp API. The release process can decide the later MCP package version bump for the new agent-facing error envelope.

Settings UX

githits settings show
githits settings get license-mode
githits settings set license-mode safe
githits settings set marketing-emails disabled
githits settings set blocked-license-ids <uuid> [uuid...]
githits settings clear blocked-license-ids
githits settings terms accept

JSON batch input is intentionally deferred until an atomic multi-setting workflow is required.

Validation

• bun test (2,626 passed)
• bun run typecheck
• bun run build
• targeted Biome format and lint checks
• source and built unauthenticated CLI smoke suites
• plugin generation/check and source/built MCP smoke suites from the terms-remediation changes
• git diff --check

Dev validation

Validated against the deployed Dev accounts and GitHits API services with a real user:

• canonical settings and terms reads work with OAuth and ghi-*
• settings --json works before or after nested subcommands
• both credential types receive TERMS_ACCEPTANCE_REQUIRED with the legal and Dev acceptance URLs
• OAuth performs one background refresh/retry while terms remain required
• ghi-* acceptance succeeds without token refresh and the immediate retry succeeds
• a stale OAuth JWT refreshes after acceptance and its retry succeeds

The user's current terms acceptance was restored and verified after the test. PkgSeer gate validation remains separate until its PR is deployed to Dev. This PR does not deploy production.