stash CLI: non-interactive / agent-friendly auth + region flags

[coderdan]

Make the stash CLI drivable by agents (and CI / pipes), not just interactive humans — additively, so nothing changes for a person in a real terminal.

Motivation: npx stash init (and stash auth login) hung on an interactive region picker with no non-interactive escape hatch — the last blocker to scripting stash init (DATABASE_URL / proxy / handoff-target already had escape hatches).

Shipped in #569

• --region <slug> / STASH_REGION on auth login + init — skip the region picker; a missing/unknown region in a non-TTY context exits with an actionable error instead of hanging.
• stash auth login --json — newline-delimited device-code events. The first (authorization_required) carries the verification URL, so an agent can trigger auth and hand the browser step to a human — only a human completes it. --no-open suppresses the browser launch.
• stash auth regions (+ --json → [{slug,label}]) — discover valid --region values up front instead of learning them from an error.
• Region resolution mirrors the DATABASE_URL resolver (TTY && !CI gate); lives in a native-free module with unit + E2E coverage.

Follow-ups (not in this PR)

• Single source of truth for the region list. Today it's hardcoded in the CLI (packages/cli/src/commands/auth/region.ts, // TODO: pull from the CTS API); @cipherstash/auth treats region as an opaque string and packages/stack/packages/protect only carry a single-value CtsRegions type. When a CTS region API exists, the CLI + SDK should both read from it.
• Add a changeset ('stash': minor) — omitted from feat(cli): non-interactive / agent-friendly auth + region flags #569 because it lives outside packages/cli.

PR: #569