feat: add namespaced debug logging inspired by npm's debug package

[steve-calvert-glean]

Summary

• Adds internal/debug package providing zero-cost namespaced debug logging, inspired by npm's debug package
• Activated via GLEAN_DEBUG env var with glob patterns (e.g. GLEAN_DEBUG=auth:*) or --verbose/-v flag
• Instruments the full auth flow, HTTP transport layer, config resolution, streaming chat, session persistence, and TUI initialization
• Replaces silent error swallowing (_ = err) with debug-logged best-effort operations
• Adds "Tip: re-run with -v or GLEAN_DEBUG=auth:* for details" hint on auth failures

Namespaces

Namespace	What it traces
auth:login	Overall login flow orchestration
auth:resolve-host	Host resolution and domain lookup
auth:discovery	OAuth endpoint discovery (RFC 9728, OIDC, RFC 8414)
auth:dcr	Dynamic Client Registration
auth:token	Token load, expiry, refresh
auth:email	Email extraction from JWT/OIDC
http:request	Outgoing HTTP method + URL
http:response	HTTP status + round-trip timing
client:resolve	Credential source selection (API token vs OAuth)
config:load	Config source priority (env → keyring → file)
config:keyring	Keyring access attempts and failures
stream:connect	SSE connection lifecycle
stream:parse	NDJSON line parsing and malformed line skipping
session:persist	Session save/load failures
tui:init	TUI component initialization

Example

$ GLEAN_DEBUG=auth:*,config:* glean auth status
  config:load       env: host=false token=false +0ms
  config:keyring    get host: secret not found in keyring +12ms
  config:keyring    get token: secret not found in keyring +12ms
  config:load       after keyring: host=false token=false +0ms
  config:load       loaded config file: ~/.glean/config.json (53 bytes) +0ms
  config:load       after file: host=true token=false +0ms
  config:load       resolved host=company-be.glean.com token=false +0ms
✓ Authenticated as user@company.com (company-be.glean.com)
  Token expires 2026-04-16T21:11:36Z (in 165h14m0s)

Test plan

• go test ./... -count=1 — 419 tests pass
• golangci-lint run — clean
• mise run build — binary builds
• Debug disabled by default — ./glean auth status shows no debug output
• GLEAN_DEBUG=* — full trace to stderr
• GLEAN_DEBUG=config:keyring — only keyring logs shown
• GLEAN_DEBUG='*,-config:keyring' — negation works
• ./glean -v auth status — verbose flag enables all debug
• Auth failure shows "Tip: re-run with -v" hint (suppressed when debug active)
• Race detector passes: go test ./internal/debug/... -race

🤖 Generated with Claude Code

[rwjblue-glean]

This looks great. It's a great base to build on even more stuff if we want to in the future as well.