feat(cli): sign in with an app password for unattended sync

[BryanFRD]

Second layer of #261: the client and the CLI sign in with an app password.

• Remote::with_app_password authenticates every request with Basic auth instead of a Bearer token. mint_app_password and revoke_app_password wrap the existing routes.
• The CLI reads STASHDEN_EMAIL and STASHDEN_APP_PASSWORD (or --email / --app-password) and prefers them over STASHDEN_TOKEN.
• stashden login <email> --create-app-password <name> mints one and prints the two variables to keep, for a sync --watch that runs unattended.

End-to-end tests in api/tests/client.rs run the client against the real API: an app-password client lists and uploads, cannot mint another one, and is signed out once revoked.

Refs #261

[ferrfleet]

The auth plumbing is correct. Caller on the base branch accepts Basic app-password credentials, SessionCaller returns 403 for them, and the three new tests match that behaviour. The Authorize swap covers every request site.

One blocking finding: the minted app password response is redefined in the client instead of being shared through stashden_core. One nit on an export that has no use yet.

[ferrfleet]

dcc59ac has the same diff as e568ca0 and looks like a rebase. The blocking thread on crates/client/src/remote.rs (move MintedAppPassword into stashden_core and redact secret in Debug) is still open. Nothing new to report.

[ferrfleet]

0626f4d drops Credential from the re-exports, which settles the nit. The blocking thread on crates/client/src/remote.rs is still open: MintedAppPassword is still defined in the client, not shared from stashden_core, and its derived Debug still prints secret. Nothing new in this push.

[ferrfleet]

f769eb6 re-applies the lib.rs export change already reviewed in 0626f4d; no other code changed. The blocking thread on crates/client/src/remote.rs is still open: MintedAppPassword is still defined in the client rather than shared from stashden_core, and its derived Debug still prints secret.

[ferrfleet]

78aa97e moves the minted app password type into stashden_core::app_password, matching how share::Minted is set up (postgres-gated FromRow, Debug with the secret redacted, wire-shape test). The blocking thread is resolved and no findings remain.