fix: persist oauth host without keychain prompts

[chris-freeman-glean]

Summary

• Persists the resolved host to ~/.glean/config.json during OAuth login so credentials remain usable after GLEAN_HOST is unset
• Adds SaveHostToFile() that writes only the host to the config file without touching the system keyring, avoiding macOS Keychain prompts for a non-secret value
• Fixes Logout() to properly clean up all auth artifacts — OAuth tokens, client registration, keyring entries, and config file — instead of just deleting the config file

Problem

After a successful glean auth login, the CLI could end up in a broken state: the OAuth access token was stored (in ~/.local/state/glean-cli/), but the resolved host was never persisted to ~/.glean/config.json.

If the host originally came from the GLEAN_HOST environment variable, opening a new shell without it meant the CLI couldn't find the host → couldn't look up the tokens → reported "not authenticated" even though valid tokens were on disk.

Changes

File	Change
internal/auth/auth.go	New persistLoginState() saves both host and tokens atomically after login. Logout() now calls DeleteTokens → DeleteClient → ClearConfig instead of raw os.Remove. resolveHost() uses SaveHostToFile to avoid unnecessary keyring writes.
internal/auth/storage.go	New DeleteClient() for cleaning up stored OAuth client registrations on logout.
internal/config/config.go	New SaveHostToFile() — file-only host persistence that skips the keyring entirely.
internal/auth/auth_persistence_test.go	Integration tests reproducing the exact failure: save tokens with env host, unset env, confirm auth breaks. Then confirm persisted host fixes it and logout cleans everything.
internal/auth/storage_test.go	Test for DeleteClient.
internal/config/config_test.go	Test for SaveHostToFile confirming keyring is not touched.

Test plan

• mise run test:all passes
• Built ./glean and manually reproduced the old token-without-host failure in an isolated HOME, then verified persisted host state fixes it
• glean auth logout clears all auth state (tokens, client, config, keyring)