Summary

This PR refactors the installer scripts and CLI onboarding flow to delegate configuration management securely to the native lrc binary.

• New lrc onboard Command: Introduced a non-interactive onboarding command that natively handles API key validation, auth token exchange, backups, and atomic configuration writing with strict file permissions (0600).
• Installer Wrappers: Refactored lrc-install.sh and lrc-install.ps1 to act as clean download wrappers that delegate validation and config generation directly to lrc onboard. Removed obsolete shell/PowerShell TOML parsing helpers.
• Credential Hardening: Leveraged urfave/cli to bind authentication flags directly to the LRC_API_KEY environment variable, preventing credentials from appearing in process lists.

Linked Issue

Link the agreed issue this PR fulfills.

Validation

Describe the most specific test or validation you ran.

Checklist

• This PR fulfills an agreed issue.
• I kept the change narrow and scoped.
• I ran the most specific relevant validation and described it above.
• If I changed behavior, I called that out clearly in this PR.
• If I touched UI, I attached a GIF or video walkthrough. This is required.
• If I changed storage/ responsibilities, I updated storage/storage_status.md and ran make check-status-doc.
• If I changed network/ responsibilities, I updated network/network_status.md and ran make check-status-doc.
• If this change touches security, disclosure flow, credentials, storage, network behavior, or remote data handling, I reviewed SECURITY.md and updated related documentation if needed.

Notes For Reviewers

Anything specific you want reviewers to focus on.