feat(login): add --local for OTP delivery via the instance response

[Bccorb]

Summary

Local and self-hosted instances without a real mail or SMS provider could not complete OTP login through the CLI: the code was generated and stored only as a hash, never surfaced anywhere. seamless login --local closes that gap.

With --local, the CLI asks the instance for external delivery (x-seamless-auth-delivery-mode: external), reads the OTP back from the response, and verifies with it automatically. No prompt, no real email or SMS needed.

Behavior

• Gated to local hosts. Running --local against a remote instance is rejected with a clear message.
• Requires the auth API to run outside production with ALLOW_UNCREDENTIALED_DELIVERY_SECRETS=true. If the instance does not return a code, the CLI fails with an actionable error naming that flag rather than silently prompting.
• Falls back to the normal code prompt if no code is auto-filled (for example on a resend).

Usage

Server (auth API), non-production:

ALLOW_UNCREDENTIALED_DELIVERY_SECRETS=true npm run dev

CLI (profile pointed at a local instance):

seamless login you@example.com --local

Notes

• Not an API contract change: the external-delivery header and delivery.token response field already ship. This is CLI-side only.
• Complementary to the recently merged letter-based email OTP prompt fix (fix(login): accept letter-based email OTP codes at the code prompt #69), which hardens the manual prompt. --local skips the prompt entirely.

Testing

• npm run build: clean
• npm test: 588 passed, 4 skipped
• Added unit and command tests covering the external-delivery header, auto-fill, the missing-code error, and the non-local guard.