feat(cli): add private NanoShare sync client

- Add a separate installable NanoShare CLI package under cli/.
- Implement browser login with local callback and refresh-token config.
- Add upload, list, download, sync, and watch CLI commands.
- Add private owner-only file download endpoint for CLI downloads.
- Add CLI auth endpoints for browser login and token refresh.
- Return file_id from ServiceLink uploads for reliable sync state.
- Exclude the CLI package from NanoShare container builds.
- Include tests for private downloads and sync state updates.

cli/nanoshare_client/config.py

@@ -0,0 +1,20 @@
+from __future__ import annotations
+
+from pathlib import Path
+
+DEFAULT_CONFIG = Path('~/.config/nanoshare/config.toml').expanduser()
+
+def write_config(path: Path, *, node: str, url: str, refresh_token: str, token_url: str, source: str = 'nanoshare-cli') -> None:
+  path = path.expanduser()
+  path.parent.mkdir(parents=True, exist_ok=True)
+  content = '\n'.join([
+    f'source = "{source}"',
+    f'refresh_token = "{refresh_token}"',
+    f'token_url = "{token_url}"',
+    '',
+    '[nodes]',
+    f'{node} = "{url.rstrip("/")}"',
+    '',
+  ])
+  path.write_text(content)
+  path.chmod(0o600)