bos-auth: 01 bos login — session + scoped FC key export, bos.config.json driven

Sprout of #274 (v2 platform services spec). Ticket 01 of the gasless-auth sprint (frontier, parallel with #290).

What to build

bos login gives a human (or agent) a way to establish publish identity with zero keys on disk by default:

1. bos login (interactive): opens a wallet-approval popup (SIWN/NEP-413 browser flow at minimum), creates a session bound to the NEAR account, and persists a session handle under .bos/ (gitignored). Sessions are short-lived; the handle is re-verifiable server-side against nonce + recipient.
2. bos login --key: additionally mints/exports a function-access key scoped to the FastKV registry contract for headless use (CI and agents). This is the "AI agent signs with its own NEAR key" loop, preserved first-class.
3. bos.config.json is the single declarative surface: the config's account + extends chain picks the auth target; optional publish.auth = "session" | "key" selects the default credential kind. No auth state lives outside .bos/state.json-style local files mirrored by the config's declared account.

Acceptance criteria

• bos login gets a session binding the NEAR account without asking for a seed phrase or private key
• bos login --key produces a scoped function-call key that works when NEAR_PRIVATE_KEY is consumed by the existing publish path
• bos.config.json declares the auth contract (account, optional publish.auth), and a mismatched session is rejected with a clear error
• Sessions expire; re-login is non-destructive for an existing key
• Logout deletes both the handle and exported key

Blocked by

• none (frontier)