Summary

`grounds push` was failing for users with credentials.json files written by the CLI:

```

Task :groundsPush FAILED
Failed to parse credentials file at ~/.config/grounds/credentials.json:
Field 'version' is required for type with serial name
'gg.grounds.push.client.CredentialsFile', but it was missing at path: $
```

Root cause: The Gradle plugin's `CredentialResolver` (grounds-push) requires `version: 1`, but the CLI's `Credentials` struct never had a `version` field — schemas drifted because both were created in single-shot commits and never cross-synced.

Fix

• Add `Version int` field to `Credentials`; `CredentialsVersion = 1`.
• `Marshal()` always sets `Version = CredentialsVersion` so callers can't forget.
• `ParseCredentials()` silently upgrades pre-version files (`version: 0` after parse → bumped to 1). They get re-written with the correct version on the next refresh/login.

Test plan

• `go test ./internal/auth/...` passes
• New tests verify Marshal always writes `version: 1`
• New tests verify legacy files (no `version` field) parse and upgrade
• After upgrade, `grounds login` produces a credentials.json that `grounds push` can read
• User with existing credentials can either re-login OR add `"version": 1,` manually as a one-time migration

Cross-repo contract: must stay in lockstep with `grounds-push` `plugin/src/main/kotlin/gg/grounds/push/client/CredentialResolver.kt`. Both files now reference each other in their doc comments.

🤖 Generated with Claude Code