Classify reused CLI auth tokens

[jahooma]

Summary

• Replace destructive CLI auth token deletion with an atomic move from cli-login:<token> to cli-login-consumed:<token>.
• Teach onboarding to distinguish reused opaque tokens from never-issued/missing tokens.
• Show a specific already-used login-link message for duplicate/reopened browser requests instead of falling through to invalid auth code.
• Add helper coverage for reused-token and missing-token classification.
• Update auth docs to describe the consumed marker.

Validation

• bun test web/src/app/onboard/__tests__/helpers.test.ts freebuff/web/src/app/onboard/__tests__/helpers.test.ts web/src/app/api/auth/cli/code/__tests__/origin.test.ts freebuff/web/src/app/api/auth/cli/code/__tests__/origin.test.ts
• bunx prettier --check docs/authentication.md web/src/app/onboard/__tests__/helpers.test.ts web/src/app/onboard/_db.ts web/src/app/onboard/_helpers.ts web/src/app/onboard/page.tsx freebuff/web/src/app/onboard/__tests__/helpers.test.ts freebuff/web/src/app/onboard/_db.ts freebuff/web/src/app/onboard/_helpers.ts freebuff/web/src/app/onboard/page.tsx
• bun run typecheck in web/
• bun run typecheck in freebuff/web/
• git diff --check