[jefft72]

Summary

Adds Diffex account authentication to the CLI through diffex auth login, diffex auth status, and diffex auth logout.
The login flow uses device authorization and stores the resulting session in the operating system keychain without exposing tokens in terminal output.

Reasoning

This milestone connects the CLI to Diffex account identity without prematurely coupling authentication to hosted cloud operations.
Credentials must remain out of plaintext files and terminal output, while the browser handoff, polling behavior, refresh rotation, and logout path need predictable failure handling.

Changes

• Adds parsing and dispatch for Diffex account login, status, and logout commands
• Implements device authorization startup and bounded polling with pending, slowdown, retry, and expiry handling
• Refreshes expiring sessions and rotates refresh tokens before reporting authenticated status
• Removes local credentials even when remote logout confirmation is unavailable
• Stores versioned account sessions in the operating system keychain without a plaintext fallback
• Loads native keychain support only when an account command accesses credentials
• Reports safe account-specific errors when keychain support is unavailable
• Requires HTTPS verification URLs for deployed APIs and limits HTTP URLs to local development
• Rejects verification URLs containing credentials or mismatched completion origins
• Adds the pinned keyring dependency and updates generated dependency locks
• Adds regression coverage for polling, refresh, logout, keyring storage, and unsafe verification responses

Testing

• npm exec -- vitest run packages/coding-agent/test/account-auth-storage.test.ts packages/coding-agent/test/account-auth-command.test.ts
• npm run check
• npm run build

[Pepps233]

Remove existing auth routings through diffex auth login, diffex auth status, and diffex auth logout. Instead, route auth using existing slash commands /login and /logout because they are the two main interfaces for interacting with model auths.