feat(cli): add private NanoShare sync client

- Add a separate installable NanoShare CLI package under cli/.
- Implement browser login with local callback and refresh-token config.
- Add upload, list, download, sync, and watch CLI commands.
- Add private owner-only file download endpoint for CLI downloads.
- Add CLI auth endpoints for browser login and token refresh.
- Return file_id from ServiceLink uploads for reliable sync state.
- Exclude the CLI package from NanoShare container builds.
- Include tests for private downloads and sync state updates.

cli/README.md

@@ -0,0 +1,20 @@
+# NanoShare CLI
+Desktop CLI and folder sync client for NanoShare.
+
+## Install locally
+```bash
+uv tool install ./cli
+```
+
+## Login
+```bash
+nanoshare login https://your-nanoshare.example
+```
+
+## Sync
+```bash
+nanoshare sync ~/NanoShare
+nanoshare watch ~/NanoShare --interval 10
+```
+
+The CLI stores config in `~/.config/nanoshare/config.toml` and sync state in `.nanoshare-sync/state.json` inside the synced folder.