feat(cli): agent login, logout and whoami

[marslavish]

Summary

• agent login — interactive sign-in to the Constructive platform: backend preset picker (localnet / devnet / custom), inline email + password, mints a 5-year full_access API key.
• agent logout revokes the API key and clears the session; agent whoami shows the account with a masked key.
• Session persists in the airpage StoredSession shape at ~/.constructive/config/agent/account.json, mode 0600. Backend choice persists next to it.
• The generated pi db-tools extension reads the credential store on every tool call; CONSTRUCTIVE_* env vars override it (the CI/headless path). Tokens never enter process.env.
• Startup re-mints the API key when it is within 7 days of expiry — fire-and-forget, never blocks.
• agentic/pi gains an optional host signInHint, so signed-out failure reasons say Run `agent login` to sign in. in the CLI.
• Fix found in QA r1: inquirerer applies its 15s inactivity timeout in TTY mode, which killed login for anyone pausing at a prompt; login now disables it.
• Fix found in QA r2: inquirerer drops a stdin chunk that carries more than one keypress (paste, fast typing), which truncated passwords and failed sign-in with a misleading MFA error; login now splits coalesced chunks into single keys (src/keypress-chunks.ts).

Review notes

• Live-backend e2e verified against localnet (port 6464): interactive login, key mint, whoami, store-backed authenticated call, env override rejection, server-side key revocation on logout — full report in the task's qa.md (r2: 17 pass / 0 fail / 0 unverifiable).
• The backend caps API-key expiry at 1 year even when the CLI requests expiresIn: { years: 5 } — server policy; the 7-day re-mint check keeps keys fresh.
• Pre-existing workspace:* protocol lines for @agentic-kit/harness and @agentic-kit/pi in agentic/cli/package.json were left as-is (only the new dep follows workspace:^).
• Both inquirerer defects (inverted idle-timeout condition; coalesced-chunk drop) deserve upstream fixes — the CLI carries local workarounds.

[marslavish]

New on this branch — entity-type + API-key tooling for pi (through dc0cab8bd):

• manage_entity_types tool: list/create/delete entity-type registrations on modules.<host> (immutable — no update); confirm-gated
• create_api_key tool: principal-owned keys, entity-scoping + read-only via create-time probe, reuse guard, one step-up retry via host hook, plaintext only through host.deliverSecret
• pi host hooks (requestStepUp, deliverSecret), harness confirm-gates, default constructive-skills skill source

Review notes:

• manage_entity_types delete filters by entity_type_id only — cross-database authorization is server-side and not provable from this repo
• Airpage runs published @agentic-kit/pi@0.5.2; in-app e2e needs a publish + bump
• QA fix dc0cab8bd: reuse path mints with the principal's identity userId (row id fails PRINCIPAL_NOT_OWNED), proven against a live stack