Add icp-cli Internet Identity login support

[humandebri]

Summary

• Add Kinic Portal support for the icp-cli Internet Identity login flow.
• Allow kinic-cli --identity <name> to use icp-cli identities linked with icp identity link ii.
• Keep the existing kinic-cli --ii flow available as legacy behavior.

Changes

• Add /.well-known/ic-cli-login and /cli-login to the portal.
• Generate and POST a delegation chain back to the local icp-cli callback.
• Restrict CLI callbacks to 127.0.0.1 and [::1].
• Add CSP support for II login, local callbacks, and runtime API/MCP origins.
• Read icp-cli Internet Identity registry and delegation files from kinic-cli.
• Validate that linked II identities use https://memory.kinic.xyz as the host.
• Show clear recovery messages for expired delegations, unsupported storage, wrong host, and invalid CLI login URLs.
• Update CLI docs to recommend icp identity link ii <name> --host https://memory.kinic.xyz.

Validation

• cargo test icp_cli_identity --lib
• cargo test
• pnpm --filter @kinic/kinic-portal typecheck
• pnpm --filter @kinic/kinic-portal exec vitest run --config vitest.config.ts src/routes/cli-login-page.test.ts src/worker.test.ts src/ssr.test.tsx