login: XDG config paths and non-clobbering multi-identity key files

[sini]

Summary

Two storage-layout changes, predicates for the refresh-daemon work discussed in #606:

1. XDG config-path support

The client config now resolves through the first existing of:

1. $XDG_CONFIG_HOME/opk/config.yml when the variable is set and absolute (the XDG Base Directory spec requires relative values to be ignored), otherwise ~/.config/opk/config.yml on Linux/macOS or %AppData%\opk\config.yml on Windows. These are replacement semantics per the spec, matching git/gh.
2. The legacy ~/.opk/config.yml (all platforms).

An existing ~/.opk/config.yml keeps working untouched and always wins when it is the only config. Fresh --create-config runs write the XDG location with 0700/0600 (the config can carry client_secret values). opkssh login -v names the config file in use. The old --config-path help text claiming %APPDATA%\.opk on Windows was incorrect (the code always used ~/.opk on every platform) and is fixed on both commands that carry the flag.

2. Non-clobbering multi-identity key files

Today a second identity's login either overwrites the first's ~/.ssh/id_ecdsa (any opkssh cert may clobber any other, because the check is the openpubkey comment alone) or fails with "no default ssh key file free". Now:

• A default slot is reusable iff it is free, holds a certificate for the same identity, where identity is (iss, aud, sub) parsed from the embedded PK token and failing closed, or holds a cert whose PK token no longer parses but whose comment is exactly openpubkey (so every legacy file behaves exactly as before).
• When all default slots belong to others, keys go to the opkssh identity directory (~/.ssh/opkssh/, created on demand together with its IdentityFile config fragment, inert without the explicit --configure Include, which this PR never touches), named <issuer>-<client_id> or, when a different account at the same provider collides, suffixed with an 8-hex sha256(iss|aud|sub) tag (hashed because some OPs use emails as subjects, which don't belong in file names). A foreign occupant at the tagged path is an error, never an overwrite.
• A warning naming the written path fires only when the fallback was used and no ssh-agent ended up holding the key. Login loads the agent as of login: load certificate into ssh-agent with configurable lifetime #611, which is the primary discovery path for non-default names.

Single-identity users keep byte-identical behavior throughout, as the fallback machinery only engages when a second identity actually appears.

Intentional behavior changes

• All-default-slots-taken now succeeds into the identity directory instead of erroring.
• A parseable certificate belonging to a different identity is never overwritten.
• A missing ~/.ssh/opkssh/ directory or config fragment is created on demand rather than being an error.
• addCertToAgent and maybeAddCertToAgent now report whether the key reached an agent, which is what lets the fallback warning stay silent when an agent is holding the key.

Notes

• Fragment IdentityFile paths containing blanks are now double-quoted per ssh_config token rules (an unquoted path with a space is mis-parsed by OpenSSH, common with Windows home directories). Login's writer and logout's remover render lines through one shared function, so matching and removal cannot drift; blank-free paths stay unquoted so existing fragment entries keep matching exactly.
• docs/cli/ is regenerated (opkssh gendocs) for the changed help text.
• Tests: config-chain resolution table (XDG replacement semantics, relative-value rejection, legacy precedence), identity-slot behaviors (same-identity in-place overwrite, legacy-comment fallback, different-identity preservation + fallback, tagged-path foreign-occupant error, partial-state guard, fragment whole-line dedup), warning matrix (fires/silent), and config-create permissions.

Design spec (with the review history behind these decisions): https://gist.github.com/sini/c32d1b73adbb56f1bdbbe620b10dc80f