[FEATURE] Add a fixed callback port for browser authentication

Use Case / Problem

Interactive browser authentication currently lets MSAL choose an ephemeral localhost callback port. When Fabric CLI runs on a remote machine over SSH, users cannot reliably preconfigure port forwarding between the local browser and the remote callback listener.

Proposed Solution

Add fab auth login --redirect-port <port> for interactive user authentication.

Expected behavior:

• Accept ports 1 through 65535.
• Skip authentication-method selection and use browser authentication when interaction is required.
• Pass the fixed port to MSAL's local callback listener.
• Temporarily disable Windows/macOS authentication brokers so MSAL honors the port.
• Reject combinations with Azure CLI, managed identity, and service-principal options.
• Return an actionable error when the port cannot be bound.
• Preserve existing silent-cache behavior and all default login behavior when omitted.

Remote usage:

ssh -o ExitOnForwardFailure=yes -L 8400:127.0.0.1:8400 user@remote
BROWSER=echo fab auth login --redirect-port 8400

Alternatives Considered

• Device-code authentication: useful for headless environments but does not provide the same browser callback flow and is tracked separately in #215.
• Relying on an ephemeral port: cannot be forwarded predictably before login.
• Preflight-binding the port: introduces a race; the implementation should let MSAL perform the real bind.

Impact Assessment

• This would help me personally
• This would help my team/organization
• This would help the broader fabric-cli community

Implementation Attestation

• I understand this feature should maintain backward compatibility with existing commands
• I confirm this feature request does not introduce performance regressions for existing workflows
• I acknowledge that new features must follow fabric-cli's established patterns and conventions

Implementation Notes

I have a tested implementation ready in my fork and would like maintainer acknowledgment before opening the PR, per the contribution guide. Please add the help wanted label if the team accepts this contribution. The implementation includes parser, command, core auth, error handling, documentation, tests, and a Changie entry.

Start by tracing the auth login parser and command into the core authentication implementation. Review the existing error handling, documentation, tests, and Changie entry described in the issue. Done means the redirect-port behavior and validation work without changing default login or silent-cache behavior.