feat(login): browser-default flow with email/password CI fallback

CLAUDE.md

@@ -236,6 +236,11 @@ Subcommands MUST NOT redeclare a global flag — duplication makes the local fla
   - `CGO_ENABLED=0` at build time. goreleaser config enforces this.
   - No reading or modifying user shell rc files (`.bashrc`, `.zshrc`). `newapi completion` *prints* completion scripts to stdout; users install them.
   - No spawning external tools at runtime (no `git`, `curl`, `jq` shellouts). All HTTP via `net/http`; all JSON via `encoding/json`.
+    - **Exception**: launching the user's default browser via `open` (darwin)
+      / `xdg-open` (linux) / `rundll32` (windows) is allowed as a *best-effort*
+      convenience in the `login` flow. The CLI always prints the URL to stderr
+      first, so if the launcher fails or the binary is missing, the user can
+      paste it manually — these binaries are never a hard dependency.
   - Update checks (if added) MUST be opt-in via flag, never a background fetch on startup.
 - **Cross-platform**: releases ship darwin/linux/windows × amd64/arm64. CI cross-compiles on every push.
 - **Backward compat**: these contracts are versioned with the CLI's major version. Breaking any of them requires a major bump.

README.md

@@ -7,7 +7,7 @@
 
 > A fast, single-binary command-line client for [new-api](https://github.com/QuantumNous/new-api) gateways. Ships as the `newapi` binary.
 
-[Features](#features) • [Install](#install) • [Quick start](#quick-start) • [Commands](#commands) • [Scripting](#scripting-with-newapi)
+[Features](#features) • [Install](#install) • [Quick start](#quick-start) • [Logging in](#logging-in) • [Commands](#commands) • [Scripting](#scripting-with-newapi)
 
 ---
 
@@ -74,6 +74,24 @@ newapi chat -i -m gpt-4o-mini
 newapi usage --from 2026-05-01 --group --top 5
 ```
 
+## Logging in
+
+Browser flow (default, recommended):
+
+```bash
+newapi login --endpoint https://api.example.com
+```
+
+This opens your default browser to `<endpoint>/cli-login`, lets you sign in with any method the server supports (password, OAuth, Passkey, 2FA), and returns an access token to the CLI via a short-lived 127.0.0.1 loopback. The token is stored in the OS keychain (or a 0600 file fallback). Pass `--no-browser` for headless/SSH sessions to print the URL without trying to launch anything.
+
+CI / scripts (non-interactive):
+
+```bash
+newapi login --endpoint https://api.example.com \
+    --email me@example.com --password "$NEWAPI_PASSWORD" \
+    --profile prod --no-pick-key
+```
+
 ## Configuration
 
 `newapi` keeps a small YAML config at `~/.config/newapi/config.yaml` (XDG-compliant; override with `NEWAPI_CONFIG_HOME`). Secrets are stored separately in the OS keychain — the config only holds *references* to them.