Auth core: multi-profile config store

[Bccorb]

Summary

Introduce a config layer that lets the CLI target multiple Seamless Auth instances (self-hosted, managed tenant, local dev) under named profiles. This is the foundation the rest of the auth work builds on.

Tasks

• Define config at ~/.config/seamless/config.json, respecting XDG_CONFIG_HOME.
• Profile shape: { name, instanceUrl, sub, email, identifierType }. No secrets in this file (tokens live in the keychain, see the token storage issue).
• Active-profile selection via a --profile <name> flag and a SEAMLESS_PROFILE env var, defaulting to a default profile.
• Commands: seamless profile list, seamless profile use <name>, seamless profile remove <name>.
• Validate and normalize instanceUrl (require https outside localhost, strip trailing slash).

Acceptance criteria

• Config persists across invocations and round-trips cleanly.
• Switching profiles changes which instance subsequent commands target.
• The file contains no tokens or secrets.

Part of #38