feat(cli): harden auth secret input handling

[smekcio]

Summary

• harden secret handling in auth CLI commands
• support hidden interactive prompts when secret options are omitted
• keep environment-variable fallback for automation compatibility
• warn when secrets are passed directly via CLI options

Changes

• auth login-token:
  • hidden prompt fallback for token when not provided and env is missing
• auth login-xades:
  • hidden prompt fallback for --pkcs12-password / --key-password when omitted
• Added runtime warnings for inline secret flags:
  • --ksef-token
  • --pkcs12-password
  • --key-password
• Added integration tests for warning/prompt paths
• Updated CLI docs

Validation

• python -m pytest -q
• Result at submission time: 401 passed, 4 skipped