feat: enhance connect init with full device setup

[lee-reinhardt]

Summary

avocado connect init is now a full end-to-end setup command. After running, the project is ready to build and boot with auto-claiming devices.

What connect init does

1. Authenticates — verifies login, creates org-scoped token/profile if needed
2. Selects org/project/cohort — interactive prompts or --org/--project/--cohort flags
3. Fetches server signing key — retrieves the TUF server key for the selected org
4. Writes connect: block — sets org, project, and server_key in avocado.yaml
5. Adds connect extensions — ensures avocado-ext-connect-config, avocado-ext-connect, and avocado-ext-tunnels are in the extensions definitions and the runtime's extensions list (avocado-ext-connect-config is ordered before avocado-ext-connect for overlay precedence)
6. Sets up config overlay — ensures avocado-ext-connect-config has an overlay: field and creates the overlay directory structure
7. Creates claim token — calls the Connect API to create a claim token (named connect-init-<timestamp>, no expiration, cohort-scoped if applicable)
8. Writes device config — writes overlay/etc/avocado-conn/config.toml with claim token, device ID source, data dir, and keepalive interval (prompts before overwriting existing config)

New flags

• --cohort <ID> — scope the claim token to a specific cohort
• -r / --runtime <NAME> — target runtime for extensions (default: dev)

New files

• src/utils/config_edit.rs — surgical YAML editing that preserves comments and formatting (add/remove packages, ensure extensions, set overlay fields)