cli/auth: unhide `entire auth token`

Make the control-plane bearer helper discoverable in entire auth --help and agent-help instead of a hidden scripting-only escape hatch. It still prints a live credential (documented as a secret in the doc comment), resolves the same bearer the API client uses (ENTIRE_TOKEN verbatim, else the refreshed active-context login JWT), and keeps errors on stderr so command substitution stays clean. Behavior is unchanged; only visibility. The --insecure-http-auth flag stays hidden.