[Bug]: Setup doesn't always pop-out auth window

### Bug Description

When running `altis-cli config setup` the pop-out auth doesn't occur. You need to run a command to get the auth to pop-out into a browser.

It's also been reported that running `altis-cli config reset` first is required, then rerunning `altis-cli config setup`, again, and finally running an arbitrary command seems to force the auth pop-out to happen.

### Steps to Reproduce and Code Sample

1. Run `altis-cli config setup`
2. observe nothing happens.
3. run `altis-cli config reset`
4. Run `altis-cli config setup` again
5. run an arbitrary command
6. observe auth pop-out to browser occurs
7. success

### Expected Behaviour

Running `altis-cli config setup` should force the popout

### Additional Info

Claude Findings:

F1. Root cause. lib/commands/config/setup.js never calls the login flow. It only asks "Reset?" when a token already exists, then writes config.json and prints "Saved configuration!". The OAuth browser flow lives in VantageAPI.authenticate() in lib/vantage.js and only runs on the first API request. That is why stack list opened the browser. Same code in the published 1.0.0-beta.1 (which Goh has, hence the "hm-cli" banner) and in unreleased 1.1.0.

F2. The double "Saved configuration!" Goh saw comes from config reset clearing didSetup, so the next altis-cli config setup runs the first-run wizard (which calls the setup handler) and then runs the setup command again.

Fix (2 files, +24/-12)

- setup.js: after saving, if no token is stored, call authenticate(), wait for the callback, then print "Logged in to Altis Dashboard." Also sets didSetup itself.
- bin/altis-cli.js: skip the first-run wizard when the invoked command is config setup, so reset-then-setup runs login once instead of wizard, login, then a "Reset?" prompt.

Start in lib/commands/config/setup.js and trace VantageAPI.authenticate() in lib/vantage.js to understand when the browser flow runs. Check bin/altis-cli.js for the first-run wizard path when config setup is invoked. Done means altis-cli config setup opens the browser authentication flow directly, including after config reset, without duplicate setup prompts.

Written by the indexing model from the issue text.