feat(cli): login command with console session pairing

### Description

Using filecoin-pin today means pasting a wallet private key into the shell. That key controls every fund in the wallet and never expires, and agents driving the CLI have no other way to get credentials.

`filecoin-pin login` replaces that with a scoped session key: the CLI generates the key, opens the Filecoin Cloud console for one wallet approval, polls `SessionKeyRegistry` for the grant, and prints a readiness scorecard. No callback server. Auth and funding stay separate steps; funding never blocks login.

PRD: https://app.notion.com/p/filecoindev/Login-Auth-3cadc41950c180a6b663f8024e7ca423 (v2, 2026-08-27). Sections 6, 8, 9 are the UX contract, scope, and acceptance criteria. This issue tracks the engineering work; it does not restate the PRD.

Ground rules from the PRD: the code is a self-contained module inside filecoin-pin, and no existing data command changes syntax or behavior.

One change to the PRD: decision #14 named `~/.filecoin-session-key.env`. The session env file goes in the existing filecoin-pin data dir instead, next to the other per-user state.

### Impact

Blocks agent onboarding and any team with a key-handling policy.

### MVP scope (PRD section 8)

- `login`, `logout`, `balance`, `dashboard`
- credential auto-load: flags, then env vars, then the session env file in the filecoin-pin data dir (`getDataDirectory()` in `src/config.ts`, platform-specific), then the no-credentials error
- funds preflight in `add`
- per-command scope gating with add-scopes links

### Children

- [x] #670 `--scopes` on create/authorize/revoke
- [x] #671 `--env-file`
- [x] #687 per-command scope gating (depends on FilOzone/filecoin-pay-explorer#355)
- [x] `login` and `logout`
- [ ] credential auto-load and the no-credentials error
- [ ] `add` funds preflight
- [x] `balance` and `dashboard`

Console work is tracked in FilOzone/filecoin-pay-explorer#368.

Related, not blocking: #457 (credential storage). `--json` output (#4) is its own epic and is not a pre-requisite for login.