fix(auth) Provide a better tooltip + resolve logout cleanup issue

[nickschuch]

Changes

• Classify token refresh failures instead of leaking the raw oauth2 error. Only an expired or revoked refresh token asks the developer to login again — an unreachable identity provider or a network failure keeps its own message.
• Map gRPC Unauthenticated responses to the same message, so developers who have never logged in get the hint too instead of a raw rpc error. PermissionDenied is left alone, because you are authenticated in that case.
• Render the hint with a fang error handler, reusing the existing tooltip component from config list and logs list. Set SKPR_DEBUG=1 to see the underlying error.
• skpr logout now removes the local credentials even when the refresh token has already expired. Previously it failed before the delete, so logging out and back in could not recover the session.
• Fix a swallowed error where a missing id_token returned nil, leaving the CLI to run with empty credentials.
• Fix two misleading errors in skpr login: a state mismatch reported %!w(<nil>), and a callback server failure was printed and then ignored.
• Store the cached refresh token as 0600 in a 0700 directory.

Screenshot