fix(auth): auto-provision staging environment after login

[nicknisi]

Summary

After workos auth login succeeds, the CLI now automatically fetches staging credentials and saves them as a default "staging" environment. This bridges the OAuth auth system with the API key system so management commands (e.g., workos env list) work immediately without requiring a manual workos env add step.

What was tested

Automated

• 1030/1030 tests pass (8 new tests added)
• pnpm typecheck clean
• pnpm build clean
• New tests cover: success path, existing env preservation, env update, and failure paths (403, 404, network error, timeout)

Manual

• Code review of login.ts diff verified provisionStagingEnvironment is called after saveCredentials in runLogin, wrapped in try/catch, returns boolean
• Confirmed all error paths return false and never throw
• Confirmed active env logic correctly uses isFirst || !config.activeEnvironment guard
• Verified type compatibility with staging-api.ts and config-store.ts

Verification

CLI-only change with no frontend UI. Verification based on comprehensive test execution and code review.

Screenshots

Issue

User-reported: after workos auth login, workos env list showed "No environments configured." Expected login to bootstrap a default environment.

Follow-ups

• Consider making the auto-provisioned environment name configurable (currently hardcoded to "staging")
• Could add a --no-auto-env flag to skip auto-provisioning if needed