#3770 fix(cli): verify the token with the control plane on auth login

chainloop auth login reported a successful login for any string that parsed as a JWT. An expired token, or a token from a different instance, gave "login successful!", and the next command then failed with an authentication error.

Before the CLI saves the token, it now asks the control plane for the session of the token (ContextService/Current, which does not need an organization). If the control plane rejects the token, the login fails with a clear error and the CLI saves nothing. The headless flow (pasted token) and the browser callback flow both do this check. The gRPC connection options are moved into a helper so the login can reuse them.

Closes #3769

This PR was written with AI assistance (Claude Code).