CLI auth referrer flags are accepted but have no effect

[tobyhede]

stash auth login --supabase, --drizzle, and --prisma compute a referrer
string, but the login function receives it as an unused parameter. The bundled
CLI guidance nevertheless describes these flags as referrer tracking.

This creates a public surface that appears successful while doing nothing.

Decision required

Choose one supported contract:

• remove or deprecate the inert auth-login flags and correct the guidance; or
• carry their value through a deliberately supported attribution channel.

Acceptance criteria

• No auth-login path computes a referrer value that nothing consumes.
• CLI help, the bundled skill, and runtime behaviour describe the same contract.
• Combined flags have an explicit, tested meaning if the flags remain.
• Any removal follows the package's compatibility and changeset policy.