Wire auth and locale to shared.json, AI settings to cli.json

[bcotrim]

Related issues

• Related to STU-1350

How AI was used in this PR

All code was generated via Claude Code (Opus + Haiku). Changes were reviewed and validated by the author through iterative conversation — verifying architecture decisions, confirming read/write boundaries, and running the full test suite at each step.

Proposed Changes

• Create tools/common/lib/shared-config.ts — new shared config infrastructure at ~/.studio/shared.json for data shared between Desktop and CLI (auth token + locale)
• Wire Desktop auth reads/writes to shared-config instead of appdata
• Wire Desktop locale reads/writes to shared-config instead of appdata
• Wire CLI auth reads/writes to shared-config instead of appdata
• Move CLI-only AI settings (aiProvider, anthropicApiKey) from appdata to cli.json
• Move CLI telemetry (lastBumpStats) from appdata to cli.json
• Remove authToken, locale, AI fields, and lastBumpStats from appdata types and schemas
• Add 20 tests for shared-config and update all affected test files

After these changes the write boundaries are:

• Desktop → appdata-v1.json (sites, snapshots, preferences) + shared.json (auth, locale)
• CLI → cli.json (sites, AI settings, telemetry) + shared.json (auth) + appdata-v1.json (snapshots only)

Testing Instructions

• Run npm run typecheck — should pass with no errors
• Run npm test — all 1292 tests should pass
• Manual: launch Desktop app, log in via WordPress.com — verify ~/.studio/shared.json contains the auth token
• Manual: change language in Preferences — verify ~/.studio/shared.json contains the locale
• Manual: run studio auth login from CLI — verify shared.json is updated
• Manual: run studio ai and switch provider/enter API key — verify ~/.studio/cli.json contains aiProvider and anthropicApiKey

Pre-merge Checklist

• Have you checked for TypeScript, React or other console errors?