feat(cli): add auth fallback, completion install, and assistant streaming

[Microck]

Summary

• Add kagi completion generate and kagi completion install for bash, zsh, fish, and PowerShell.
• Make assistant --stream emit text deltas by default, with --stream-output json for structured NDJSON events.
• Verify API-first base search falls back to session auth on API rejection/rate-limit responses.
• Update README, command docs, install guide, output contract, coverage, and llms index.

Verification

• cargo test
• ./target/debug/kagi completion generate fish
• SHELL=/usr/bin/fish XDG_CONFIG_HOME=<tmp> ./target/debug/kagi completion install
• ./target/debug/kagi assistant --help
• ./target/debug/kagi completion --help
• Live session-token smoke test: ./target/debug/kagi assistant --stream 'Reply with exactly OK and nothing else.'

Refs #116

[Microck]

Additional live verification

Ran real endpoint checks with the configured KAGI_SESSION_TOKEN without printing credential values.

• ./target/debug/kagi auth check passed with session-token (env).
• ./target/debug/kagi search 'kagi cli live session test' --format json --limit 1 returned a live Kagi result.
• ./target/debug/kagi search 'kagi cli live session test' --format pretty --no-color --limit 1 returned a live pretty result.
• ./target/debug/kagi assistant --stream 'Reply with exactly LIVE-TEXT-OK and nothing else.' streamed LIVE-TEXT-OK.
• ./target/debug/kagi assistant --stream --stream-output json 'Reply with exactly LIVE-JSON-OK and nothing else.' emitted JSON stream events ending with markdown LIVE-JSON-OK.
• SHELL=/usr/bin/fish XDG_CONFIG_HOME=<tmp> ./target/debug/kagi completion install wrote a real fish completion file in the temp config dir.
• Live fallback test: with [auth] preferred_auth = "api", an intentionally invalid KAGI_API_KEY, and the real KAGI_SESSION_TOKEN, kagi search 'kagi cli failover live test' --format json --limit 1 succeeded with a live result.
• Negative control: the same invalid KAGI_API_KEY with no session token failed against Kagi's real API with general.invalid_token, proving the successful fallback test was not an API success.

A real valid KAGI_API_KEY is not present in this shell or .kagi.toml; kagi auth status reports API key and legacy API token as not configured. The live API rejection/fallback path is verified, but a valid paid API-key success path could not be tested without that credential.

[Microck]

Additional valid API-key verification

Configured KAGI_API_KEY in the global shell startup file, before the non-interactive ~/.bashrc guard, without storing it in the repository.

Verified with the session token explicitly unset:

• source ~/.bashrc; env -u KAGI_SESSION_TOKEN ./target/debug/kagi auth status reports api-key (env).
• source ~/.bashrc; env -u KAGI_SESSION_TOKEN ./target/debug/kagi auth check passes with api-key (env).
• source ~/.bashrc; env -u KAGI_SESSION_TOKEN ./target/debug/kagi search 'kagi cli api only explicit source test' --format json --limit 1 returns a live V1 Search API result.
• With [auth] preferred_auth = "api" and both credentials available, kagi search 'kagi cli api preferred with valid key test' --format json --limit 1 returns a live result through API-first routing.

This covers the valid paid API-key success path that was missing from the earlier live verification. The previous live fallback check still covers API rejection -> session fallback.