feat(e13-s6): add --auto/-a one-flag local credential sweep with dedup

[imneov]

What

Collapses the five source flags into one. claudecm add <name> --auto (-a) sweeps every local source at once and skips credentials you already have — the "just find my key" path.

• Sweep (best-effort, one source failing never aborts the others, zero network): clipboard → environment → ~/.claude/settings.json → ~/.codex/{auth.json,config.toml}.
  • Clipboard via pbpaste/wl-paste/xclip/xsel/PowerShell Get-Clipboard behind an injectable seam; absent tool → skipped with a reason, never fails.
  • Env via envextract; config files via the existing claude-code / codex adapter Import.
• Dedup by normalized (base_url, api_key) against LoadAllProfiles() → each candidate marked NEW or already recorded as <profile> (secrets redacted).
• Decision (refuse-don't-guess): no key → refuse naming swept sources; all already recorded → informational exit 0, nothing written; exactly one NEW → build the draft; multiple NEW → interactive pick in a TTY, refuse with a redacted list non-interactively.
• Mutually exclusive with --from-*/--preset, and (post-review) with the identity flags --api-key/--base-url; reuses --dry-run/redaction/validation/overwrite; no auto-activation.

Review trail

Fresh-context adversarial review → REQUEST_CHANGES (2 High + 3 Medium), all remediated in 9444f9a:

• High — --auto --api-key= could write a keyless profile (identity check ran before flag override). Fixed: no-key check now applies to the final merged draft including --auto.
• High — --auto --api-key <existing> could bypass dedup. Fixed: --auto is now mutually exclusive with the identity flags (--api-key/--base-url); --model etc. still allowed.
• Medium — default-port dedup miss (:443 vs none), JSON-mode disambiguation list missing, test harness couldn't simulate --api-key=. All fixed.

Evidence

• Live (real ~/.claude/~/.codex copied into an isolated HOME): sweep found env + ~/.claude candidates, clipboard + malformed codex config skipped with reasons, multi-NEW non-TTY refused; after recording one, re-run reported already recorded as envp and built the sole remaining NEW as a draft.
• Real binary: --auto --api-key= refuses (exit 1); --auto --api-key/--base-url refuse (mutual exclusion); --auto --model allowed.
• go test ./... + go vet ./... clean; adversarial review confirmed no secret leakage, no clipboard command-injection, best-effort source isolation.

🤖 Generated with Claude Code