forge CLI: login, logout and client setup for Docker, NuGet, npm and Helm #167

Part of #44. A small CLI on top of the shared client crate (#162). It is the one place a user signs in for every helper. Depends on #39's device-flow endpoints. Packaging and releases are #166.

Commands

Signing in

• forge login <url>: a device-flow sign-in in the browser (Forge login, OIDC/Entra). The token goes into the keychain.
• forge logout [<url>]: revokes the token on the server and removes it locally.
• forge status: lists the Forge hosts and who is signed in to each.

Client setup

• forge configure docker <url>:
  • adds "<host>": "forge" to credHelpers in ~/.docker/config.json, keeping every other entry;
  • does the same for Podman, Buildah and Skopeo in containers-auth.json;
  • authentication then goes through docker-credential-forge (docker-credential-forge: credential helper for Docker, Podman, containerd and Helm OCI #163).
• forge configure nuget <url> [--repo <name>]: adds the source to the user (or --project) NuGet.config with no credentials, since nuget-plugin-forge (nuget-plugin-forge: NuGet authentication plugin written in Rust #164) supplies them.
• forge configure npm <url> --repo <name>: writes the registry line to .npmrc. Authentication stays with npm login --auth-type=web (npm registry: hosted, proxy and group repositories with npm login #41), so npm needs no helper.
• forge configure helm <url>: Forge serves Helm charts from its OCI registry only (Serve Helm charts from the OCI registry only, with a chart page in the web UI #435), so Helm signs in as Docker does: this registers docker-credential-forge (docker-credential-forge: credential helper for Docker, Podman, containerd and Helm OCI #163) for the host in the registry config Helm reads (see docker-credential-forge: credential helper for Docker, Podman, containerd and Helm OCI #163). There are no classic chart repositories, so nothing is written to repositories.yaml and no token is minted.

Every configure command prints what it changed and supports --dry-run.

Acceptance criteria

• e2e: forge login approved through the mock IdP harness, then forge configure docker|nuget|npm|helm followed by a pull, restore or install with the real client.
• Config edits keep existing entries, with tests for each file format (JSON, NuGet.config XML, .npmrc).
• forge logout revokes the token on the server and the token page no longer shows it.
• Docs: a "Sign in with the forge CLI" section on each format's "connect your client" page (Client login for every format: Nexus-style logins, UI-minted tokens, browser/OAuth login #39).