Rewrite sync flow and introduce ssh command

[JKetelaar]

Summary

• rewrites sync from scratch around runtime Inventory API resolution and interactive execution flow
• introduces ssh as the primary Boundary host command and keeps login as a deprecated alias
• hardens map for CI/CD by making it non-interactive by default and improving symlink behavior
• adds full auth, org, and site management command groups backed by the Inventory API
• standardizes interactive selector UX across commands for cleaner, more consistent terminal output

Added and changed features

Sync command redesign

• replaces the legacy sync argument model with sync [env-or-host]
• supports scope flags: --files, --database, --all, plus --dry-run, --yes, --site-id, --org-id
• resolves target sites by querying Inventory on every run, with interactive site selection fallback
• detects the source host where possible and excludes it from candidate targets
• prompts for target SSH host/user/port each run (not persisted)

File sync behavior

• rewrites file sync to rsync push mode from source paths to target host over SSH
• supports multiple configured mappings under sync.files.items
• prompts for mappings only when missing, then persists only those path mappings

Database sync behavior

• adds MySQL sync implementation using mysqldump piped over SSH into mysql on target
• validates required binaries and credentials and includes pre-import confirmation
• gathers database connection inputs interactively per execution and does not store them in config

Auth and Inventory integration

• adds appconfig support for internal auth and inventory settings
• switches default inventory API base URL to HTTPS
• adds Clerk OIDC login, refresh, revoke, and local session storage utilities
• includes public_metadata in default Clerk scopes
• adds a typed Inventory API client and shared inventory helper wiring

New command groups

• adds auth command group with login, logout, status, org, org select, and org show
• adds org command group with organization SSH key management flows
• adds site command group with add-ssh-key, env, and redirect management flows

Host access command update

• adds intercube ssh as the preferred host-access command
• keeps intercube login as a deprecated alias with warning message
• updates root help text and onboarding guidance accordingly

Map command hardening

• makes map fail fast by default when mappings are missing (pipeline-safe default)
• adds optional --interactive setup mode when users want prompting
• keeps --override support, improves error handling, expands home paths, and handles already-correct symlinks idempotently

Selector and prompt UX polish

• adds shared selector template helpers for consistent active, inactive, and selected styling
• removes noisy empty separators and ID-heavy labels from site selectors
• improves readability of site, org, redirect, env-variable, ssh key, host, and sync target pickers

Config and docs

• updates configuration model to support sync.files.items mapping
• updates onboarding and README to document the new sync, ssh, and map behavior

Dependencies

• adds dependencies required by auth and session plumbing, including go-keyring and related transitive modules