feat(login): log in with Dash0's first-party OAuth client on Dash0-hosted API URLs

[securitymirco]

Summary

dash0 login registers its own OAuth client (RFC 7591 dynamic client registration) on first login. The authorization server cannot distinguish that client from any other client using the same name, so the consent screen cannot present the CLI as an official Dash0 application.

With this change, logins against Dash0-hosted API URLs use a fixed, pre-provisioned client ID (dash0-cli). Logins against any other API URL, such as a local stack or a custom deployment, keep using dynamic registration and the ~/.dash0/oauth-clients.json cache.

• Dash0-hosted URLs are recognised by deriveAppHost, the strict matcher already used for the post-login redirect (api.dash0.com, api.<region>.aws.dash0.com, and the dash0-dev.com equivalents).
• The client ID is public by design. It is only usable with loopback redirect URIs, and PKCE stays mandatory.
• Existing profiles keep the client ID they were issued with, so token refresh and logout keep working. The next dash0 login moves them to the new client and revokes the previous refresh token under its original client ID, as re-login already does.
• docs/commands.md and the matching skill reference are updated, and a changelog entry is included.

Testing

• New unit test TestEnsureRegisteredClient_Dash0HostedUsesFirstPartyClient: Dash0-hosted URLs resolve to the fixed client without calling the registration endpoint.
• Existing integration tests run against a local fake authorization server, so they still exercise the dynamic-registration path unchanged.

🤖 Generated with Claude Code

[github-actions]

Thank you for your submission - we really appreciate it ❤️. We kindly ask that you sign a Contributor License Agreement before we can accept your contribution.

You can sign the CLA by posting a pull request comment containing the same as the text below.

If you are contributing on behalf of a company, the company should contact us to sign a Corporate Contributor License Agreement, via hi@dash0.com.

---

I have read the CLA Document and I hereby sign the CLA

---

_{You can retrigger this bot by commenting recheck in this Pull Request. Posted by the CLA Assistant Lite bot.}