Restrict CLIAuthProvider to only work with PasswordBased root keys

In order to support a clean interactive authentication flow without any confusion about when a password prompt should be popped up to the user, we need to distinguish between POD User Keys that come from passwords and those that are centrally managed and distributed as random nonce values.

This means that `CLIAuthProvider` should only respond to a new `PasswordBasedRootKey` key type and not generic UserKey requests. Device interactions that support a distinction between password based and raw user keys such as authentication over bluetooth can first request for a UserKey and if that fails request for a PasswordBasedRootKey in order to give interactive login methods a try as a last resort.

Locate CLIAuthProvider and the PasswordBasedRootKey definition, then trace how UserKey requests are dispatched to authentication providers. Confirm the distinction used by device interactions, and identify the relevant authentication tests or entry points. Done means CLIAuthProvider responds only to PasswordBasedRootKey requests while the documented fallback flow remains possible.

Written by the indexing model from the issue text.