fix(auth): report gateway authentication status

[drew]

Summary

Make openshell status report gateway reachability and authentication independently, and fix Microsoft Entra OIDC refresh requests by resending the configured resource scopes. Centralize the non-interactive refresh-token exchange in openshell-sdk while keeping browser login and token persistence in the CLI.

Related Issue

N/A — no matching issue found.

Changes

• Keep the public health check independent from authentication, then use the existing protected OpenShell.GetGatewayInfo capability query as the authentication probe.
• Treat a successful capability query as authenticated and authorized, PermissionDenied as authenticated but unauthorized, and Unauthenticated as rejected credentials.
• Report authenticated, failed, not-required, and unverified states separately from gateway reachability, including compatibility handling for gateways that predate GetGatewayInfo.
• Extend SDK OIDC refresh input with scopes and reuse the SDK exchange from the CLI.
• Preserve rotated refresh tokens in CLI gateway storage and add regression coverage for Entra-style scoped refresh.
• Update architecture, published authentication and gateway-management docs, and CLI agent guidance.

Testing

• mise run pre-commit passes
• cargo test -p openshell-cli gateway_status passes (5 tests)
• Unit tests added/updated
• E2E tests added/updated (not applicable; this version adds no server API or authentication-middleware changes)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[elezar]

As a general question. Should the openshell status command support JSON output? (This may already be covered by #1989.

[drew]

As a general question. Should the openshell status command support JSON output? (This may already be covered by #1989.

This looks covered by the other open PR.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2435.docs.buildwithfern.com/openshell