login: show auth host instead of the long authorize URL

The browser flow now prints "Logging in to: <auth host>" rather than the full authorize URL (the PKCE challenge + loopback redirect made it long and unreadable). The full URL is shown only as a fallback when the browser can't be opened, which is also what a headless host hits.

openBrowser reports failure under test (no usable browser on a CI host, and we mustn't spawn a real one), so the integration test recovers the ephemeral loopback callback URL from that fallback line on stdout — replacing the file-based seam from the previous iteration.