[建议 / Feature] Non-interactive credential status & refresh for headless/CI use (zcode login --status / --refresh)

提交前确认 · Pre-submission checklist

• 我已搜索过现有 issue，确认这不是重复提议 / I searched existing issues and confirmed this isn't a duplicate.
• 我已阅读 CONTRIBUTING.md / I've read CONTRIBUTING.md.

问题类别 · Category

账号 / 登录 · Account / Login

涉及的 Agent 框架 · Agent framework

不涉及框架 · Not framework-specific

使用场景 · Use case

We operate a fleet of scheduled headless agents (~150 zcode --prompt turns/day across CI jobs, schedulers, and long-lived automation on macOS/Linux boxes). Credential health is currently invisible until a turn dies mid-flight: there is no command a script can run to ask "are the Z.AI credentials valid, and when do they expire?"

Verified on v0.16.5 today:

• zcode --help offers only login (interactive OAuth; --no-browser prints a URL) and logout.
• zcode login --help prints the root help — no subcommand flags documented (also a discoverability gap).
• zcode doctor reports runtime/packaging only, no auth state.
• No documented non-interactive refresh path; credentials live under ~/.zcode (e.g. v2/credentials.json) with no documented lifecycle.

During a recent OAuth-lapse window our scheduled turns failed for days before anything noticed — partly our own tooling gap (we captured no exit codes; since fixed), but there was also no surface for us to check credential health against even if we had tried.

建议方案 · Proposal

1. zcode login --status --json — machine-readable credential health: valid | expired | missing, expiry timestamp when known, exit non-zero when unusable, never opens a browser.
2. zcode login --refresh — non-interactive refresh for already-authorized machines (keychain/agent-provided or documented env-var fallback honored by the built-in Z.AI provider).
3. (minor) Make zcode login --help show login-specific flags instead of the root help.

预期价值 · Expected value

Turns credential health into a checkable invariant for CI/schedulers (cron probe + alert instead of silent multi-day turn failures). Directly prevents the incident class we hit.

你认为的优先级 · Your perceived priority

高 · High

你使用的 ZCode 版本 / 环境 · ZCode version / environment

zcode 0.16.5 / macOS 15.6 (Apple Silicon) / Z.AI Coding Plan (GLM)

补充材料 · Additional context

Happy to attach redacted logs (~/.zcode/**/log/*.jsonl) or a scripted repro if useful.

Start by reviewing the existing zcode login, zcode login --help, and zcode doctor entry points, along with the credential location ~/.zcode/v2/credentials.json. Define the non-interactive status and refresh behavior, including JSON output, expiry reporting, exit codes, and browser avoidance; done means CI can reliably detect and refresh credential health.