auth: drop auth list, show active sessions in auth status

Remove the entire auth list command. The rows it listed are server-side login sessions (OAuth refresh-token families), not personal access tokens — nothing functional depends on listing them (see COR-389 notes). Fold that view into entire auth status as a clearly-labelled "Active sessions" table, reusing the table renderer.

auth revoke <id> still works; the session IDs now come from auth status.

Sessions

Changes

• cmd/entire/cli
  • Mauth.go+48/-84
  • Mauth_test.go+26/-58

import (
    "context"
    "encoding/json"
    "errors"
    "fmt"
    "io"
    "github.com/spf13/cobra"
)

// authTokenLister lists API tokens for the authenticated user. The
// implementation resolves its own data-API bearer via
// auth.TokenForResource (RFC 8693 exchange in split-host setups, same-
// host shortcut otherwise); callers don't pass a bearer through, which
// removes the temptation to forward the wrong-audience keyring token.
// authTokenLister lists the authenticated user's active login sessions —
// the server-side refresh-token families (one per `entire login`, across
// all devices), surfaced by `entire auth status` and used by revoke as a
// liveness probe. Despite the api.Token name, these are sessions, not
// personal access tokens; the CLI never mints them. The implementation
// resolves its own data-API bearer via auth.TokenForResource (RFC 8693
// exchange in split-host setups, same-host shortcut otherwise); callers
// don't pass a bearer through, which removes the temptation to forward the
// wrong-audience keyring token.
type authTokenLister func(ctx context.Context) ([]api.Token, error)

// authTokenRevoker revokes a single API token by id. Same bearer-...