feat(plugins): add product-owned Auth and shared catalogue loading

[flemzord]

Summary

Auth can now use a product-owned embedded plugin or an independently distributed executable. The host shares provider selection and exact-version checks between Auth and Ledger, while retaining credentials, connection selection and terminal behavior.

fctl auth / ledger
  -> cached provider metadata
  -> exact service-version check
  -> embedded package or verified native executable

plugins install, sync and show accept --service auth; Ledger remains the default. Auth and Ledger retain independent target locks. Catalogue discovery accepts YAML or JSON and uses the official registry, with embedded fallback for unprepared targets when no matching official release is available. Help and completion remain offline.

Depends on formancehq/auth#162. The Auth dependency points to its published branch revision with verified Go checksums and no local replacement. This PR targets feat/stack-v4-cli, which contains the v4 foundation; it does not include the entire v3-to-v4 rewrite against main.

Evidence

• Before: Native provider selection and management were specific to Ledger; Auth implementation lived in fctl.
  After: Auth and Ledger use shared loading and distribution boundaries, and fctl embeds the product-owned Auth package.
• Targeted race tests cover actual Auth product executables installed locally and downloaded through a loopback OCI registry, exact-version/revision selection, separate locks, version drift before writes, runtime manifest validation and offline metadata.
• just pc, the full just tests race suite and targeted SDK race tests pass after syncing the current v4 foundation. The dependency is fetched from GitHub without a local workspace.

Merge Danger

Door: two-way

Blast Radius: CLI

Provider preparation, catalogue discovery and Auth dependency loading change. Only Auth and Ledger service roots are accepted, and foreign service overrides are rejected. No data migration, deployment, registry upload or official catalogue publication is performed. Merge the Auth dependency PR and confirm its final module revision before merging this PR.

[NumaryBot]

The required automated review completed with no remaining findings.