feat(cli): add private NanoShare sync client

- Add a separate installable NanoShare CLI package under cli/.
- Implement browser login with local callback and refresh-token config.
- Add upload, list, download, sync, and watch CLI commands.
- Add private owner-only file download endpoint for CLI downloads.
- Add CLI auth endpoints for browser login and token refresh.
- Return file_id from ServiceLink uploads for reliable sync state.
- Exclude the CLI package from NanoShare container builds.
- Include tests for private downloads and sync state updates.

routes/api/link.py

@@ -47,7 +47,7 @@ async def files_upload(params, ctx):
 
   file_name = params.get('file_name') or iso_stamp_filename('mesh', default_ext)
   storage_id = await current_app.convex.send_to_storage(data=data, content_type=content_type)
-  await current_app.convex.add_file(
+  file_record = await current_app.convex.add_file(
     file_name=file_name,
     file_size=format_size(len(data)),
     note=params.get('note', ''),
@@ -56,7 +56,8 @@ async def files_upload(params, ctx):
     storage_id=storage_id,
     user_id=user_id,
   )
-  return {'file_name': file_name, 'size': len(data), 'content_type': content_type}
+  file_id = file_record.get('file_id') if isinstance(file_record, dict) else None
+  return {'file_id': file_id, 'file_name': file_name, 'size': len(data), 'content_type': content_type}
 
 @router.method('files.list')
 async def files_list(params, ctx):