feat: enhance claim-tokens create with cohort selection and tags

[lee-reinhardt]

Summary

Enhances avocado connect claim-tokens create with interactive project/cohort selection and tag support.

What changed

• Interactive cohort picker: When --cohort is not provided, the CLI walks through project selection → cohort selection (same flow as connect init). Auto-selects when only one option exists. Falls back to org-scoped token if no projects or cohorts are found.
• Tag support: New --tag / -t flag (repeatable) associates tags with devices claimed using the token. Tags are validated server-side (max 20, no spaces or commas).
• --cohort flag: Accepts a cohort ID directly, skipping the interactive picker. No --project required — the API validates the cohort ID.
• --project flag: Optionally pre-selects the project for the cohort picker, skipping the project prompt.

Usage examples

# Interactive: prompts for project then cohort
avocado connect claim-tokens create --name my-token

# Non-interactive: cohort ID directly
avocado connect claim-tokens create --name my-token --cohort <id>

# With tags
avocado connect claim-tokens create --name my-token -t production -t us-west -t batch-march2026

# Full non-interactive
avocado connect claim-tokens create --name my-token --cohort <id> -t production --no-expiration