Adds a browser-based sign-in flow so users can authenticate the Dash0
Claude Code plugin once and have it emit telemetry on their behalf.

- /dash0-agent-plugin:login slash command runs OAuth 2.0 + PKCE against
  Clerk (Dash0's identity provider). Discovery via RFC 8414 metadata,
  PKCE S256. Defaults to https://clerk.dash0.com; auto-selects the
  dev tenant when DASH0_OTLP_URL points at a .dash0-dev.com host.

- Credentials are persisted to the OS user-config dir (mode 0600):
    ~/Library/Application Support/dash0/credentials.json (macOS)
    $XDG_CONFIG_HOME/dash0/credentials.json (Linux)
    %AppData%\dash0\credentials.json (Windows)

- After OAuth, the plugin uses the issued Clerk JWT to mint a long-lived
  auth_* token via CPA POST /public/ui/organization/auth-tokens. Falls
  back to the short-lived OAuth access_token when mint fails (e.g. dev
  envs without admin role).

- Refresh-token rotation: offline_access scope yields a refresh token;
  SessionStart hook auto-refreshes on 401, re-mints, persists, retries
  CheckConnectivity, and reports the rotated state to the user.

- SessionStart printHookResponse always emits a status line:
    - dash0: telemetry is not active        (no OTLP_URL)
    - dash0: not authenticated              (no token)
    - dash0: auth token rejected            (401 after refresh)
    - dash0: connected as <org-id>          (valid)
  The "needs login" branches put a Skill-tool nudge into
  additionalContext so Claude proactively invokes the slash command
  before continuing with the user's request.

- Per-user OAuth client registration caches client_id + the bound
  loopback port in clients.json so repeat logins reuse the same
  redirect_uri (Dash0 / Clerk enforce exact match).

- New userConfig entries: AUTH_URL, OAUTH_CLIENT_ID (plus env-var
  fallbacks DASH0_AUTH_URL, DASH0_OAUTH_CLIENT_ID).

- Drops the original region selector (us / eu / dev) and the
  DASH0_REGION env var — the URL-only model matches Dash0's real
  topology (Clerk for OAuth, CPA for mint, regional API for ingest).
  Credentials now carry AuthURL, ClientID, RefreshToken instead of
  Region/APIBase. Clients map keyed by AuthURL.

- CI adds an auth-e2e job that runs the mocked flow without an
  ANTHROPIC_API_KEY secret (works for fork PRs).

- 14 e2e scenarios + 160 unit tests cover discover/register/exchange/
  mint/refresh paths against an in-process mock Clerk-shaped server.

Replace the Clerk-specific MintMachineToken path (POST /public/ui/organization/auth-tokens)
with a call to PUT /api/auth-tokens/claude-code-plugin — the new idempotent get-or-create
endpoint added to the CPA. This removes the admin-only constraint: any org member with
allowMembersClaudeCodeAccess=true can now log in and get a permanent ingestion token.

Changes:
- Add ProvisionIngestionToken() calling PUT /api/auth-tokens/claude-code-plugin
- Add IngestionToken field to Credentials; OTLP hook prefers it over AuthToken
- Remove MintMachineToken, ErrNotAdmin, deriveCPAURL (all obsolete)
- Remove Clerk-specific ClientID/Scope login options and OAUTH_CLIENT_ID plugin config
- RefreshCredentials no longer attempts to re-mint; ingestion token persists across refreshes