login: fall back to the device flow in SSH sessions

Over SSH with a TTY, CanPromptInteractively() is true so the browser flow was chosen — but the loopback listener binds 127.0.0.1 on the remote host, where the user's local browser can't reach it; even the printed fallback URL can't complete. Detect SSH sessions via the SSH_CONNECTION/SSH_CLIENT/SSH_TTY vars sshd sets and route them to the device-code flow with a one-line explanation, the same way gh and gcloud do.

Extract the flow choice from the cobra RunE into runLoginAuto, taking a startBrowser func and the environment facts as plain values, so the selection and its stderr commentary are unit-testable with fakes. The browser-flow integration test blanks the SSH_* vars it inherits from os.Environ() so it keeps exercising the browser path when a developer runs the suite over SSH.