fix: fix auth setup gating

[NianJiuZst]

Summary

• skip API-key setup for dry-run commands so request previews work without credentials
• allow auth status and auth refresh to run their own auth handling
• treat saved OAuth credentials as satisfying auth setup for API commands
• add CLI-level regression tests for dry-run, auth status, and OAuth credentials

Root cause

The main entrypoint ran ensureApiKey for most commands before command-specific dry-run or auth handling could execute. ensureApiKey also only recognized API keys, so OAuth-only sessions were blocked before request credential resolution.

Validation

• bun test test/main.test.ts
• bun run typecheck
• bun test
• bunx eslint src/main.ts src/auth/setup.ts test/main.test.ts

Note: full repository lint still has pre-existing failures in unrelated tests: test/auth/timeout-fix.test.ts and test/client/stream.test.ts.