feat!: move login/logout to auth subcommand, add auth status

[nicknisi]

Summary

Groups auth-related commands under workos auth and adds a new status subcommand for inspecting current authentication state.

Breaking Change

workos login and workos logout are removed as top-level commands. Use:

• workos auth login — Authenticate with WorkOS via browser-based OAuth
• workos auth logout — Remove stored WorkOS credentials and tokens

New: workos auth status

Shows current authentication state at a glance:

Logged in as nick@nisi.org
Token expires in 4m 32s
Refresh token: present
Environment: staging (sandbox)

When not logged in:

Not logged in
Run `workos auth login` to authenticate

Supports --json for machine-readable output:

{
  "authenticated": true,
  "email": "nick@nisi.org",
  "userId": "user_01JA4BG95WJA49X1DXKSDET8PC",
  "tokenExpired": false,
  "tokenExpiresAt": "2026-03-05T19:43:04.155Z",
  "tokenExpiresIn": "4m 32s",
  "hasRefreshToken": true,
  "activeEnvironment": { "name": "staging", "type": "sandbox" }
}

String reference updates

All error messages across the codebase referencing workos login or workos logout have been updated to workos auth login / workos auth logout (15 files, ~20 locations).

Implementation

• Follows existing subcommand pattern (env, organization) using registerSubcommand() utility
• workos auth with no subcommand shows help listing all three subcommands
• auth status reads from credential-store and config-store — no API calls, no side effects
• Command registry in help-json.ts updated for agent-facing command discovery