feat(cli): add private NanoShare sync client

- Add a separate installable NanoShare CLI package under cli/.
- Implement browser login with local callback and refresh-token config.
- Add upload, list, download, sync, and watch CLI commands.
- Add private owner-only file download endpoint for CLI downloads.
- Add CLI auth endpoints for browser login and token refresh.
- Return file_id from ServiceLink uploads for reliable sync state.
- Exclude the CLI package from NanoShare container builds.
- Include tests for private downloads and sync state updates.

run.py

@@ -11,6 +11,8 @@ from routes import (
   basic_bp, auth_login_bp,
   side_main_bp,
   upload_bp,
+  cli_auth_bp,
+  api_download_bp,
   health_bp
 )
 from routes.api.link import link_bp as servicelink_bp
@@ -21,6 +23,8 @@ app.register_blueprint(auth_login_bp)
 
 app.register_blueprint(side_main_bp)
 app.register_blueprint(upload_bp)
+app.register_blueprint(cli_auth_bp)
+app.register_blueprint(api_download_bp)
 
 # ServiceLink node-to-node mesh endpoint (POST /rpc)
 app.register_blueprint(servicelink_bp)