feat(cli): add private NanoShare sync client

- Add a separate installable NanoShare CLI package under cli/.
- Implement browser login with local callback and refresh-token config.
- Add upload, list, download, sync, and watch CLI commands.
- Add private owner-only file download endpoint for CLI downloads.
- Add CLI auth endpoints for browser login and token refresh.
- Return file_id from ServiceLink uploads for reliable sync state.
- Exclude the CLI package from NanoShare container builds.
- Include tests for private downloads and sync state updates.

routes/__init__.py

@@ -19,5 +19,8 @@ from .side.main import side_main_bp
 
 from .side.upload import upload_bp
 
+from .api.cli_auth import cli_auth_bp
+from .api.download import api_download_bp
+
 # Health
 from .api.health import health_bp