Support env-backed CLI server headers

[brosand]

Summary

Rebases and supersedes #1323 on current main while preserving the original author's implementation and resolving the intervening CLI auth changes.

• add repeatable executor server add --header-env Header-Name=ENV_VAR mappings
• resolve configured headers only at request time so service-token values are never stored in the profile
• apply the headers to API calls, login discovery, device-code requests, token polling, and OAuth refresh
• keep headers scoped to the Executor server origin so they are not sent to third-party OAuth providers
• preserve current actionable 401 login guidance while sending configured headers

This supports Cloudflare Access service-token profiles such as:

executor server add cloudflare https://executor.example \
  --header-env CF-Access-Client-Id=EXECUTOR_CF_ACCESS_CLIENT_ID \
  --header-env CF-Access-Client-Secret=EXECUTOR_CF_ACCESS_CLIENT_SECRET \
  --default

Why a replacement PR

The original #1323 branch is owned by ramarivera/executor, so this account cannot update it in place. This branch replays Ramiro Rivera's commit onto current upstream main; the commit retains Ramiro as author.

Validation

• bun run format:check
• bun run lint
• SDK header tests: 6 passed
• CLI server-profile and device-login tests: 9 passed
• local env-backed Cloudflare header E2E: 1 passed
• bun run typecheck in packages/core/sdk
• bun run typecheck in apps/cli
• git diff --check