feat: add SSO auth support

[phoenix-ru]

Summary

Adds AWS SSO auth mode alongside existing static AWS credentials.

Changes

• Added ssm-secrets auth --sso-start-url <url> SSO login flow.
• Uses AWS SSO/OIDC SDKs for:
  • client registration
  • device authorization
  • token polling/refresh
  • account and role discovery
  • temporary role credentials
• Stores SSO auth state in system keyring.
• Automatically refreshes cached credentials when possible.
• Opens browser for device login when deep refresh is needed and user allowed it.
• Migrates legacy static credentials to new { mode: 'static' } format.
• Added ssm-secrets wipe-credentials.
• Updated docs and exports.

Usage

Static credentials still work:

ssm-secrets auth

SSO auth:

ssm-secrets auth --sso-start-url https://d-zzzzzz.awsapps.com/start

Optional account/role hints:

ssm-secrets auth \
  --sso-start-url https://d-zzzzzz.awsapps.com/start \
  --region eu-central-1 \
  --account-id 123456789012 \
  --role-name Developer

Remove stored credentials:

ssm-secrets wipe-credentials