Cleared CLI v0.2.0 — browser OAuth login

Browser OAuth login is now available: run cleared login, then cleared auth status --validate. Includes secure macOS Keychain/Linux Secret Service storage, rotating sessions, logout/revocation, and preserved environment API-key automation.

The compatible API, V21 migration, and web consent page are deployed, with OAuth enabled. Health, consent-page serving, invalid exchange rejection and public protocol reads were verified. Real user Privy consent/login remains a user-completed verification; no production invoices/customers were created for testing.

All four binaries were built from private source tag cli-v0.2.0. Local CI passed under the approved alternative to unavailable hosted Actions. macOS ARM64 and Linux x86-64 ran natively; Intel macOS ran via Rosetta and Linux ARM64 via QEMU. Both Linux binaries passed verified Alpine checks. macOS builds are unsigned and unnotarized. Secure storage was independently verified on macOS with synthetic credentials.

Default login scopes are read-only. Invoice writes additionally require appropriate consent and an active signing session in Cleared Settings. Linux interactive OAuth requires an unlocked Secret Service on the user D-Bus session; API keys remain available for headless automation.

Install and usage: https://github.com/tinkrtailor/cleared-cli#install-v020

SHA256SUMS covers every platform archive. Private source is not published; v0.1.0 remains available.