#1789 Only documented non-interactive auth puts the password in argv; the safe SWAMP_API_KEY path is undocumented

The only documented way to authenticate non-interactively puts the credential on the command line; the way that avoids it is undocumented.

Measured on swamp --version 20260822.011157.0-sha.06b61472.

swamp auth login --help offers exactly one non-interactive route, and gives it as the worked example:

Non-interactive login   swamp auth login --username alice --password secret --no-browser

A password in argv is readable by any process on the host via /proc/<pid>/cmdline, lands in shell history, and appears in process listings. For an agent-driven or CI-driven setup — which is where non-interactive login is needed — that is the default path.

There is a safe alternative, but it is not documented anywhere I could find:

• SWAMP_API_KEY works. I found it in the binary's strings, not in swamp auth --help, swamp auth login --help, or swamp help auth (which lists only SWAMP_CLUB_URL).
• swamp auth server-login --token exists and takes a token, but targets a swamp serve instance (SWAMP_SERVE_URL), not swamp-club, so it does not substitute.

With SWAMP_API_KEY set from a secret store, swamp auth whoami authenticates correctly and swamp issue works. It is a good mechanism — it is simply invisible unless you go looking in the binary.

Requests, either or both:

1. Document SWAMP_API_KEY in swamp auth --help / swamp auth login --help, the same way --server documents env: SWAMP_CLUB_URL. This alone fixes it.
2. Add a stdin path — --password-stdin or --token-stdin — so the documented non-interactive example does not require argv. docker login --password-stdin is the familiar precedent.

Also worth considering: change the --help example for non-interactive login to the env-var form, so the first thing an integrator copies is the safe one. The current example is the one people will paste into CI.

Context for why this bit us: our house rule forbids credentials in argv, so the documented path was unusable and the usable path was undiscoverable without reading the binary. We came close to concluding there was no supported non-interactive auth at all.