⚙️ FEATURE-#269: Add dotflow login with device flow and config file

[FernandoCelmer]

Description

Add dotflow login with device flow and config file management

Summary

• dotflow login opens the browser, shows the user_code, polls /auth/cli/token, and saves the resulting API token to ~/.dotflow/config.toml.
• dotflow logout removes the saved config.
• New dotflow/core/config_file.py with TOML-minimal reader/writer and an env-over-file resolve() helper.
• ServerDefault now resolves SERVER_BASE_URL / SERVER_USER_TOKEN via resolve() so env wins and the config file is the fallback — CI/CD keeps working when env vars are set, and interactive users get the saved token.
• dotflow login tries https://www.host.dotflow.io/api/v1 first, then https://www.lib.dotflow.io/api/v1 on RequestException. --base-url / SERVER_BASE_URL skip the fallback.
• Non-interactive dotflow login --token <t> bypasses the browser for CI.

Motivation and Context

Closes #269

Types of changes

• New feature (change which adds functionality)

Test plan

• ruff check + ruff format --check.
• pytest tests/cli tests/core — includes 16 new tests (login device flow, base-url fallback, explicit-wins, logout noop/cleanup, config file roundtrip, 0600 perms, env-over-file precedence).

Checklist

• I have performed a self-review of my own code
• I have added tests that prove my fix is effective or that my feature works
• I have updated the CHANGELOG
• I have updated the documentation accordingly

Pairs with:

• dotflow-io/dotflow-api#121 — backend endpoints
• dotflow-io/dotflow-frontend#127 — authorize page

[FernandoCelmer]

🔍 Code Review

Code issues found: 2

#	Severity	Comment
1	[Suggestion]	Token file race: writable before chmod
2	[Suggestion]	slow_down aborts login flow (RFC 8628)

[FernandoCelmer]

🔍 Code Review (Re-review)

Previous issues: 2/2 fixed ✓

New issues found: 1

#	Severity	Comment
1	[Suggestion]	Unbounded interval growth on repeated slow_down