cli: reject claim-free login tokens at validation, not at save

An opaque or claims-free token could never complete a login — RecordLoginContext keys the context and keychain slot on iss and handle/sub — but it only failed at the save step with a bare parse error. validateReceivedToken now requires parseable claims, iss, and handle-or-sub up front, with errors naming the requirement.