auth refresh: include recovery command for not_logged_in rows

## Context
PR #1881 added `opencli auth refresh`. Review noted that `not_logged_in` rows should be directly actionable for agents instead of requiring them to synthesize the login command.

## Goal
Add a safe, structured recovery hint to auth refresh/status rows where appropriate, for example:

```json
{
"site": "github",
"status": "not_logged_in",
"recovery": "opencli github login"
}
```

## Requirements
- No secrets or account identifiers in recovery fields.
- Keep existing table output readable.
- Apply consistently to `auth refresh` and consider `auth status` if the row shape supports it cleanly.
- Align with existing AuthRequiredError recovery-command style.

Follow-up from PR #1881 / thread #OpenCLI:7bbdfcd2.

Start by reading PR #1881 and the existing AuthRequiredError recovery-command style. Trace the auth refresh and auth status row outputs, then verify structured and table formats. Done means not_logged_in rows show safe, consistent recovery commands without secrets or account identifiers.

Written by the indexing model from the issue text.