#2485 CLI: show API key fingerprints in auth whoami and auth token list/create

Problem

swamp-club (lab #1700) shows a fingerprint for every personal API key and collective token: the first 16 hex characters of the SHA-256 of the full key. It is the way to find the one row to revoke when a key leaks, instead of rotating every key on the account.

The CLI cannot show that value. Today a user has to compute it by hand:

printf %s "$TOKEN" | sha256sum | cut -c1-16    # macOS: shasum -a 256

This is easy to get wrong: echo or a bare jq -r pipe adds a trailing newline, the hash changes, and the fingerprint matches no row. Windows has no sha256sum. swamp auth token list prints keyPrefix (src/presentation/output/auth_token_output.ts), which is the first 12 chars of swamp_org_<hex>, so only 2 random hex characters to tell tokens apart.

Proposed solution

1. swamp auth whoami prints the active credential's fingerprint, and the apiKeyId when it comes from auth.json. Compute it locally from auth.json or SWAMP_API_KEY; no server change is needed. That turns "which key is this machine using?" into one command whose output matches a row on /u/<username>.
2. swamp auth token list shows the fingerprint field the collective-token API returns once #1700 ships (additive, next to keyPrefix), in both text and --json output.
3. swamp auth token create prints the new token's fingerprint beside the secret, so the user can record it wherever they store the token.

Derivation, to match the server exactly: hex(SHA-256(utf8(fullKey)))[0:16]. Test vector (a made-up key, not a real credential): swamp_TESTKEYabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijkl gives 7cba95208c56e033.

A fingerprint is not a credential: it is 64 bits of a hash of a ~365-bit random secret, and the server never accepts a hash in place of the key. So this does not reopen the concern behind #2449.

Alternatives

• Keep the documented shell one-liner only. It works on Linux and macOS but carries the newline trap and does not cover Windows.
• Print more of the key's plaintext prefix. That only helps keys created after a server change, while the fingerprint covers every existing key.

Depends on swamp-club #1700 for item 2 only; items 1 and 3 can land independently.