feat: add excalidraw login and logout

[dwelle]

• excalidraw login asks how to sign in, then for the key, without echoing it:

  ◆  Pick which method to sign in with:
  │  ● API key
  │  ○ OAuth (coming soon!)
  

  OAuth is listed but disabled for now. The key is checked with GET /workspaces and saved only if the API accepts it
• login --api-key <key> saves a key without asking; without a terminal, login says how to pass one instead of saving EXCALIDRAW_API_KEY
• keys are saved per API origin in ~/.config/excalidraw-cli/credentials.json (%APPDATA% on Windows), readable only by the user, so a staging key never goes to production
• the file is versioned: an older CLI refuses a file from a newer one instead of misreading or overwriting it, and login replaces a damaged file
• --api-key and EXCALIDRAW_API_KEY still win over the saved key; whoami reports which one is in use as credentialSource (flag, env, login), and login/logout warn when the variable is set
• logout removes the key for the origin; login and logout print a confirmation instead of JSON
• a valid key the API won't show the workspace for (HTTP 403: missing permission, canceled workspace) is saved with a warning quoting the API
• on Windows, writes wait up to 1 s while another program has the file open, and never leave the temporary copy behind
• prompts use @clack/prompts, bundled into a 61 KB chunk that only login loads
• tests run with an empty config directory, so a developer's saved key can't reach them; the e2e suite logs in with the live key and checks that a bad key gets 401
• checked by hand: the picker in a terminal (selecting, Ctrl+C, empty input), and storage on Windows with Windows Node 22 (paths, replacing the file, two origins, logout, file locks). Not checked: the picker on Windows, and macOS

Opus 5.5 (xhigh)