auth: drop `auth list`, show active sessions in `auth status`

Remove the entire auth list command. The rows it listed are server-side login sessions (OAuth refresh-token families), not personal access tokens — nothing functional depends on listing them (see COR-389 notes). Fold that view into entire auth status as a clearly-labelled "Active sessions" table, reusing the table renderer.

auth revoke <id> still works; the session IDs now come from auth status.