login: drop ireturn nolint via concrete flow; tidy output spacing

Avoid the ireturn lint suppression by following "accept interfaces, return structs" (as the device-flow shim already does):

• auth.BrowserAuthFlow is now a concrete struct (was an interface); StartBrowserAuth returns *BrowserAuthFlow.
• runBrowserLogin accepts a cli-local browserAuthFlow interface plus the base URL, with StartBrowserAuth moved up into newLoginCmd. The fake flow satisfies the local interface; no nolint anywhere.

Output: one space after "Logging in to:" and a single blank line before "Waiting for sign-in..." (the leading newline doubled up with the post-Enter newline).