test(cli): cover command and session behavior

[JackCuthbert]

Summary

• cover Citty command routing, generated help, output modes, usage failures, and authentication failures
• cover persistent session storage paths, permissions, expiry, corruption, cookie renewal, and rejection
• cover destructive confirmation and optimistic-concurrency retry and stop behavior
• record the CLI unit boundary in the repository testing specification

Testing approach

These tests inject HTTP, prompt, and session-store boundaries and assert observable behavior rather than implementation shape. The future third PR will exercise one packaged executable critical path through separate Node processes, without repeating the unit-level error matrix.

Validation

• bun run fmt
• bun run lint (passes with existing repository warnings)
• bun run typecheck
• bun run knip
• bun run docs:build
• bun run test (775 tests)

Stack

• Depends on feat(cli): manage Fold todos from the command line #93.
• This is PR 2: focused unit coverage.
• PR 3 will add packaged CLI integration/e2e coverage.