refactor: scope the access-token required-flag skip per command

[ffantl-ld]

Describe the solution you've provided

Commands that don't need an API token (completion, config, help, login, signup, whoami) previously skipped the required --access-token check by setting DisableFlagParsing = true. That also suppressed validation of the subcommand's own required flags.

This clears the --access-token required annotation on the specific flag instead, so those commands still parse and validate their own flags.

Related issues

Groundwork for the guided setup command (which also needs to run without a token). Split out so it can land and release on its own merit.

Additional context

Behavior-only change to cmd/root.go; no new packages.

---

Note

Low Risk
Single-file CLI bootstrap change; behavior is narrower than before (more flag validation), with no auth or API logic changes.

Overview
Auth-exempt commands (completion, config, help, login, signup, whoami) no longer skip flag handling with DisableFlagParsing. Instead, PersistentPreRun calls clearAccessTokenRequirement, which walks the command chain and removes Cobra’s required annotation (BashCompOneRequiredFlag) from --access-token when an exempt command is in the path.

That keeps those commands runnable without a token while subcommands still parse and validate their own required flags, which DisableFlagParsing blocked.

^{Reviewed by Cursor Bugbot for commit a266914. Bugbot is set up for automated code reviews on this repo. Configure here.}