feat(cli): token env vars for CI/CD auth

[dawsontoth]

Summary

Two small additions that give a clean local-login → CI/CD path so Harper credentials don't have to live in the wild:

1. harper login can emit a copy-paste CI/CD credential block. After a successful interactive login it asks (default No): "Print environment variables so CI/CD can deploy without your password?" On yes it prints the target and the long-lived refresh token, ready to paste into GitHub Actions (or other) repository secrets:

   # Harper CI/CD credentials
   HARPER_CLI_TARGET=https://my-instance:9925/
   HARPER_CLI_REFRESH_TOKEN=eyJ...
   

   The prompt is skipped when stdin isn't a TTY (e.g. a scripted/CI login driven by HARPER_CLI_PASSWORD), so it never blocks or dumps tokens into non-interactive output.

2. The CLI's Bearer-token path reads tokens from env vars. harper deploy and other remote operations now honor HARPER_CLI_OPERATION_TOKEN / HARPER_CLI_REFRESH_TOKEN (with CLI_TARGET_* aliases), so a runner can authenticate without a stored password or a prior harper login.

Behavior

• Precedence: explicit username → Basic (unchanged); else env-var tokens (override the credentials file); else ~/.harperdb/credentials.json (unchanged).
• Refresh-token-only works: if no operation token is supplied (or it's expired), the CLI mints a fresh one from the refresh token — so CI needs only HARPER_CLI_TARGET + HARPER_CLI_REFRESH_TOKEN as durable secrets.
• No file writes for env tokens: a token refreshed from env vars is used in-memory only; file-based credentials still persist their refreshed token exactly as before.

Tests

• New unit coverage in unitTests/bin/login.test.js (opt-in prints target + refresh token only; decline prints nothing) and unitTests/bin/cliOperations.test.js (env token overrides file creds; refresh-token-only minting; expired-token refresh without persisting; CLI_TARGET_* alias).
• Full bin login/cliOperations suites pass; oxlint clean.

Follow-up

• Companion docs PR in HarperFast/documentation (new env vars + a GitHub Actions example) — not included here.

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request introduces support for environment-variable-based bearer token authentication in the CLI, which is particularly useful for CI/CD environments. It allows the CLI to use HARPER_CLI_OPERATION_TOKEN and HARPER_CLI_REFRESH_TOKEN (and their aliases) to authenticate, bypassing or overriding the local credentials file. Additionally, the interactive login flow now prompts users to print these environment variables for easy setup in CI/CD pipelines. Unit tests have been added to verify these authentication flows and the environment variable output. I have no feedback to provide as there are no review comments to assess.

[claude]

Reviewed; no blockers found.