fix(auth): clearer guidance when edge-auth browser login times out

[mvanhorn]

Summary

When the Cloudflare Access edge-auth browser login timed out, the CLI printed a bare "authentication timed out" error with no indication of what went wrong or what to do next. On deployments that are not fronted by Cloudflare Access, the browser flow can never complete, so users hit the timeout with no path forward. This turns that dead end into actionable guidance that names the flow and the exact commands to fix the registration.

Related Issue

Closes #2099

Changes

On a timeout, the CLI now explains that the attempted login uses a Cloudflare Access edge-auth flow, and it tells the user how to proceed: re-register the gateway against its OIDC issuer, or use the local mTLS certificate mode when the gateway was provisioned that way. When a registration already exists it also names the remove step first, since the mode cannot be changed in place. To let the message reference the exact gateway by name, the auth flow now receives the gateway name and whether a registration already exists.

Testing

The auth crate's test suite passes locally. The change is a user-facing error message, so its behavior is exercised through the existing auth path rather than a new assertion.

• cargo test -p openshell-cli auth passes.
• mise run pre-commit passes (not run in this environment).
• Unit tests added/updated.
• E2E tests added/updated (if applicable).

Checklist

• Follows Conventional Commits.
• Commits are signed off (DCO).
• Architecture docs updated (if applicable).

AI was used for assistance.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

Thank you for your interest in contributing to OpenShell, @mvanhorn.

This project uses a vouch system for first-time contributors. Before submitting a pull request, you need to be vouched by a maintainer.

To get vouched:

1. Open a Vouch Request discussion.
2. Describe what you want to change and why.
3. Write in your own words — do not have an AI generate the request.
4. A maintainer will comment /vouch if approved.
5. Once vouched, open a new PR (preferred) or reopen this one after a few minutes.

See CONTRIBUTING.md for details.

[github-actions]

Thank you for your submission! We ask that you sign our Developer Certificate of Origin before we can accept your contribution. You can sign the DCO by adding a comment below using this text:

---

I have read the DCO document and I hereby sign the DCO.

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the DCO Assistant Lite bot.}