feat: split auth into auth.json, keep config.json token-free

[vreshch]

Summary

• Splits auth storage from config.json into dedicated auth.json file (Decision D3)
• config.json now only stores registry.url and deviceId — no tokens
• Logout (clearAuth) writes {} to auth.json instead of deleting config.json, preserving deviceId and registry
• Aligns userSchema with desktop (relaxed validators, verifiedAlias field)
• All legacy types/functions removed — clean API: loadAuth/saveAuth/clearAuth + loadAppConfig/saveAppConfig

File layout

~/.agentage/
├── auth.json          # token, expiresAt, user
└── config.json        # registry.url, deviceId (NO tokens)

Test plan

• All 168 tests pass (19 suites)
• Type-check clean (tsc --noEmit)
• Manual: agent login writes to auth.json
• Manual: agent logout clears auth.json, config.json untouched
• Manual: agent whoami reads from auth.json