fix(import): require a stored token, not just a context, for logged-in check

Addresses Copilot's review on #1774: a contexts.json entry can exist without a usable credential (partially-removed context, missing keychain token), which made importLoggedIn suppress the sync notice even though the import can't sync. Now the current context must also yield a stored token (local read via auth.LoginTokenForContext — no network).

This stays a presence check, not a liveness check: LoginTokenForContext returns a present-but-expired token without error, and verifying usability needs a network refresh we deliberately avoid on the import path. That narrow residual false-negative (expired token) is accepted to keep the check local and prompt-free; the common broken case is now handled. Adds a test for the context-present-but-token-missing case.