feat: add credentials-init, which writes the credentials file

[willkg]

Closes #193.

Adds markfluence credentials-init, which prompts for the site URL, username, and API token, checks them with Confluence, and writes the user's credentials file (~/.config/markfluence/credentials, or under an absolute $XDG_CONFIG_HOME) with mode 0600. It writes only that file and nothing in the working directory; project setup stays with #5's init. The design and its reasoning are in _plans/051_credentials-init.md, including a section on what the code review changed.

What it does

• Token without echo, through charmbracelet/x/term, which lipgloss already built in. It is now the seventh direct dependency. Ctrl-C at the token prompt restores the terminal.
• Cloud ID fetched, never asked for, from {site}/_edge/tenant_info, for *.atlassian.net sites only. An unscoped token also works through the gateway, so nobody has to know what kind of token they have. Government and isolated Cloud use a different gateway than the hardcoded api.atlassian.com, so they get no cloud ID.
• Checked before saving with the request user-info makes. A failure is classified by the response's shape, reusing the markers HTTPError.hint matches. A rejected credential, a site-domain HTML 401, another 401/403, or a non-credential 404 writes nothing. A scope mismatch counts as checked, with a warning. No response or a 5xx asks Save anyway?.
• A rerun prefills every prompt, so rotating a token is one paste. It first says it will drop comments (Ctrl-C to exit). The token and cloud ID are kept only for the same site, so one site's token is never paired with another's URL.
• Written atomically: a temp file renamed into place, writing through a symbolic link, then read back and compared.
• Environment warnings before the first question for any exported CONFLUENCE_* variable that changes what the file does.
• Refusals: no terminal on stdin or stderr, --json, --env-file, and no home directory are each a plain error, so --json still gets an errorObject.
• The "missing Confluence …" error now suggests the command when there is a credentials file to write.

Supporting changes

• internal/client:
  • new credentials.go: CredentialsPath, ReadCredentials (one read returning values, the lines a rewrite drops, and the mode), WriteCredentials, DisplayPath, FetchCloudID;
  • HTTPError.ScopeMismatch and SiteRejectedAuth, which hint now uses;
  • exported setting names, CredentialsDoc, and LooseMode.
• internal/ui: InfoStderr and SuccessStderr, so all of the command's output sits on stderr beside its prompts.
• Docs: docs/credentials.md and the README start setup with the command, and the manual steps stay as the alternative. The cloud ID is no longer described as something to leave out for a personal token. docs/confluence/api.md records that the gateway answers a wrong token on /user/current with the same v1 403 as the site.

Checked

• make check.
• Live against mozilla-hub, through a pty into a temporary config directory:
  • a good token saves and reports the account, with the file 0600 in a 0700 directory;
  • a wrong token is refused and leaves the existing file unchanged;
  • a rerun keeps the values and announces the dropped comment;
  • user-info works with the written file.
• By hand: Ctrl-C at the token prompt ends the process with echo restored.