refactor(auth): centralize credential resolution into authStage + Client

Move all credential handling out of commands into one place. authStage
resolves the credential for the command's declared `auth` and bakes it into
`ctx.client`, gating (throw) when missing; commands reach the network only
through `ctx.client` and never touch tokens or baseUrl.

- add Client (request/requestJson/uploadFile/mcp/console/url) wrapping the
  token + baseUrl; commands call it instead of self-resolving
- run(config, flags) → run(ctx) + CommandContext; migrate all 45 commands
- split domains: model = pure api-key (drop access-token fallback), console =
  config.json only (drop DASHSCOPE_ACCESS_TOKEN env)
- consolidate env reads in loadConfig; CredentialSource = flag | env | config;
  priority flag > env > config
- endpoints return paths (xxxPath) instead of full URLs; baseUrl owned by Client
- auth status now uses describeAuth
- video/download: auth "none" → "apiKey" (it needs the model API)
- dedupe fetchModelList behind an injected console-call function
- remove ensureApiKey/ensure-key.ts, prompt.ts + isInteractive, and the old
  resolveCredential/resolveConsoleGatewayCredential resolvers
- tests: adapt auth.e2e to the new auth status shape; drop the
  DASHSCOPE_ACCESS_TOKEN branch from console-readiness gates

packages/runtime/package.json

@@ -58,13 +58,9 @@
     "node": ">=22.12.0"
   },
   "inlinedDependencies": {
-    "@clack/core": "0.3.5",
-    "@clack/prompts": "0.7.0",
     "ajv": "8.20.0",
     "fast-deep-equal": "3.1.3",
     "fast-uri": "3.1.2",
-    "json-schema-traverse": "1.0.0",
-    "picocolors": "1.1.1",
-    "sisteransi": "1.0.5"
+    "json-schema-traverse": "1.0.0"
   }
 }