fix(cli): improve error message when edge-auth flow times out on non-Cloudflare deployments

Agent Diagnostic

• Explored crates/openshell-cli/src/auth.rs:158-168 — the timeout handler returns a generic message: "authentication timed out after 120 seconds. Try again with: openshell gateway login".
• Explored crates/openshell-cli/src/run.rs:1162-1195 — browser_auth_flow() is called for any HTTPS gateway without --oidc-issuer or --local. There is no detection of whether the flow failed because Cloudflare is missing vs. a transient error.
• Verified by deploying on OpenShift without Cloudflare: the timeout message gives no indication that OIDC or --local would work. Re-running gateway login produces the same timeout.

Description

When the Cloudflare Access edge-auth flow times out (no CF_Authorization cookie arrives after 120 seconds), the CLI displays:

⚠ Authentication skipped: authentication timed out after 120 seconds.
Try again with: openshell gateway login

This message is unhelpful because re-running gateway login produces the same result. The user has no indication that the flow requires Cloudflare Access, or that --oidc-issuer is the correct alternative for non-Cloudflare deployments.

Reproduction Steps

1. Deploy the gateway on any Kubernetes cluster without Cloudflare Access
2. Run openshell gateway add https://<endpoint> --gateway-insecure
3. Press Enter to open the browser
4. Wait 120 seconds

Expected: The timeout message suggests alternatives (OIDC, --local).

Actual:

⚠ Authentication skipped: authentication timed out after 120 seconds.
Try again with: openshell gateway login

Environment

• OS: macOS 15.x (Apple Silicon)
• OpenShift: ROSA HCP 4.21 (Kubernetes 1.34.2)
• OpenShell: CLI v0.0.45

Proposed Fix

Replace the timeout message at crates/openshell-cli/src/auth.rs:163-166 with actionable guidance:

⚠ Authentication timed out. The browser-based login requires a Cloudflare Access
  proxy in front of the gateway.

  If your gateway uses OIDC authentication, re-register with:
    openshell gateway add <endpoint> --oidc-issuer <issuer-url>

  If your gateway allows unauthenticated access, re-register with:
    openshell gateway add <endpoint> --local

Related

• #2057 — root issue documenting the Cloudflare edge-auth default behavior
• #2098 — auto-detect OIDC from gateway metadata (longer-term fix)

• I pointed my agent at the repo and had it investigate this issue
• I loaded relevant skills (e.g., debug-openshell-cluster, debug-inference, openshell-cli)
• My agent could not resolve this — the diagnostic above explains why

Read crates/openshell-cli/src/auth.rs:158-168, where the timeout message is returned, and review the browser_auth_flow() call in crates/openshell-cli/src/run.rs:1162-1195 for context. Replace the generic retry guidance with Cloudflare Access, OIDC, and --local alternatives. Done means the timeout output gives actionable re-registration commands for non-Cloudflare deployments.