login: simplify flow selection after review

Cleanups from a reuse/simplification/efficiency/altitude review of the browser-flow hardening commits; no behavior change:

• Collapse runLoginAuto's three trailing bools into a loginFlowFacts struct, so call sites are self-documenting instead of relying on /* useDevice */-style comments.
• Pass canPrompt into runLogin instead of re-probing /dev/tty via interactive.CanPromptInteractively() a second time on the device path.
• Slim the startBrowser adapter closure to a direct return — the typed-nil interface on error is harmless since callers check err first.
• Move the SSH_* env blanking from the one browser-flow integration test into startLoginProcess, so future login subprocess tests are SSH-safe by default (same centralization idea as GitIsolatedEnv).
• Share one noopOpenURL test helper instead of seven inline lambdas.