feat: add automatic CLI_API_TOKEN generation for the server

Implement secure auto-generation of CLI_API_TOKEN to eliminate mandatory
environment variable requirement. Token is generated once and persisted to
~/.hapi/settings.json for use by CLI on the same machine.

Changes:
- New cliApiToken.ts module with secure 256-bit token generation
- Configuration now accepts token from env, file, or generates on-demand
- Server displays prominently on first run, saves to settings
- CLI auth status command provides discovery hints for all scenarios
- Settings file parse errors fail fast to prevent data loss

cli/src/commands/auth.ts

@@ -25,6 +25,16 @@ export async function handleAuthCommand(args: string[]): Promise<void> {
         console.log(chalk.gray(`  Token Source: ${tokenSource}`))
         console.log(chalk.gray(`  Machine ID: ${settings.machineId ?? 'not set'}`))
         console.log(chalk.gray(`  Host: ${os.hostname()}`))
+
+        if (!hasToken) {
+            console.log('')
+            console.log(chalk.yellow('  Token not configured. To get your token:'))
+            console.log(chalk.gray('    1. Check the server startup logs (first run shows generated token)'))
+            console.log(chalk.gray('    2. Read ~/.hapi/settings.json on the server'))
+            console.log(chalk.gray('    3. Ask your server administrator (if token is set via env var)'))
+            console.log('')
+            console.log(chalk.gray('  Then run: hapi auth login'))
+        }
         return
     }
 

cli/src/ui/tokenInit.ts

@@ -50,7 +50,10 @@ async function promptForToken(): Promise<string> {
     const rl = readline.createInterface({ input, output })
 
     console.log(chalk.yellow('\nNo CLI_API_TOKEN found.'))
-    console.log(chalk.gray('You can set it via environment variable or enter it now.\n'))
+    console.log(chalk.gray('Where to find the token:'))
+    console.log(chalk.gray('  1. Check the server startup logs (first run shows generated token)'))
+    console.log(chalk.gray('  2. Read ~/.hapi/settings.json on the server'))
+    console.log(chalk.gray('  3. Ask your server administrator (if token is set via env var)\n'))
 
     try {
         const token = await rl.question(chalk.cyan('Enter CLI_API_TOKEN: '))