feat(auth): support custom token name and lifetime in webauth login

[tomaskir]

Description

Adds two optional flags to phase auth (webauth mode) so the minted personal access token's name and lifetime can be set at login, instead of the token always being a non-expiring username@hostname PAT.

• --token-name sets the PAT name (default username@hostname). Fixes unhelpful names under Docker, where the default resolves to root@<container-id> (feat: allow setting the token name during phase auth #303).
• --token-lifetime sets the PAT lifetime: 7d, 12h, 30m, 60s, 2w (default: never expires) (feat: allow requesting a token with a specific lifetime during phase auth #302).

Parse-safe payload change: the webauth request payload moves from the hyphen-joined port-pubKeyHex-patName string to base64(JSON) { port, publicKey, name, lifetime? } (lifetime in seconds; omitted = never expires). This is needed because a user-supplied name can contain hyphens and other characters that the old naive split on - truncated, and it matches the Console webauth page contract.

New helper util.ParseTokenLifetime converts a lifetime string to seconds (units: s, m, h, d, w).

Requires the Console side to honor the values: phasehq/console#928 and phasehq/console#937, implemented in phasehq/console#938.

Closes #302
Closes #303

Verification

• go vet ./..., CGO_ENABLED=0 go build (CI smoke test), and go test ./... pass on Go 1.24.
• util.ParseTokenLifetime is unit-tested (units, trimming/case-insensitivity, invalid inputs).
• End-to-end - ran the built binary and decoded the generated webauth URL:
  • phase auth --token-lifetime 7d --token-name "ci-prod-api" -> {"port":...,"name":"ci-prod-api","lifetime":604800} (604800 = 7d)
  • phase auth (no flags) -> {"port":...,"name":"root@<container-id>"}, lifetime omitted
  • phase auth --token-lifetime 7x -> clean validation error
  • The generated payload is accepted by the Console webauth route (console#938).

Type

• New feature

[tomaskir]

Coordinated Console side: phasehq/console#938 (parses the base64(JSON) webauth payload and mints the PAT with the requested name and lifetime).