fix(auth): report gateway authentication status

[drew]

Summary

Make openshell status report gateway reachability and authentication independently, and fix Microsoft Entra OIDC refresh requests by resending the configured resource scopes. Centralize the non-interactive refresh-token exchange in openshell-sdk while keeping browser login and token persistence in the CLI.

Related Issue

N/A — no matching issue found.

Changes

• Add an authentication-only gateway RPC and route it through the server authentication middleware without requiring application roles or scopes.
• Report authenticated, failed, not-required, not-enforced, and unverified states separately from public gateway health.
• Preserve compatibility with gateways that predate the authentication-status RPC.
• Extend SDK OIDC refresh input with scopes and reuse the SDK exchange from the CLI.
• Preserve rotated refresh tokens in CLI gateway storage and add regression coverage for Entra-style scoped refresh.
• Update architecture, published authentication and gateway-management docs, and CLI agent guidance.

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (not applicable; server authentication and multiplex integration suites cover the changed boundary)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[elezar]

As a general question. Should the openshell status command support JSON output? (This may already be covered by #1989.

[drew]

As a general question. Should the openshell status command support JSON output? (This may already be covered by #1989.

This looks covered by the other open PR.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-2435.docs.buildwithfern.com/openshell