feat: CLI auth (OAuth PKCE), project pull, inference proxy

New commands: login, logout, whoami, pull <id>
Auth: PKCE S256, localhost callback, token refresh rotation
Inference: routes through codebase.foundation when logged in
Pull: downloads project ZIP from Garage S3

Author: halfaipg