feat(cli): show command authentication requirements in help

[XXPermanentXX]

Summary

• show each command's authentication domain in root and group help
• add a concise Authentication: <label> line to leaf command help
• generate the same authentication metadata in Bailian Skill references
• point the shared setup guide to credential configuration and acquisition pages

The labels are derived directly from each command's auth metadata: API Key, Console, AK/SK, and No Auth.

Addresses #147.

Validation

• vp check — 0 errors; 3 pre-existing unrelated warnings
• vp test packages/runtime/tests packages/cli/tests/e2e/registry.smoke.e2e.test.ts — 220 passed
• pnpm run sync:skill-assets — generated 110 command references; repeated generation was idempotent
• full vp test — 861 passed, 11 skipped, 19 live-service E2E failures caused by current credentials/service availability (for example InvalidApiKey, unavailable models, site mismatch, and missing test app); no failures were in the changed help/reference paths

Notes

No Auth means the runtime does not require a pre-existing stored CLI credential. Setup commands such as auth login or workspace init may still accept credentials through their own flags.