Added the fleet and member commands with positional targets and a delete confirmation

[siliconwitch]

The fleet and member commands: fleet create, fleet list, fleet rename,
fleet transfer, fleet delete, member add, member list, and
member remove. Targets are positional throughout: fleet ids as arguments,
no --fleet, --device, or --yes, and --json is the only global flag.

• fleet delete <fleet_id> fetches the fleet's name and asks
  Delete "name" and release its devices? [y/N] on stdin. Only y or yes
  proceeds, a closed stdin aborts, and there is no bypass flag.
• client.go gained the authenticated request builder; a missing or empty
  key file gets the local not-logged-in hint without a round trip.
• fleets.go holds the fleet fetch shared by fleet list and the delete
  prompt.
• The stub rows for the device verbs show the agreed positional shapes:
  claim <imei> <fleet_id> [name], devices [fleet_id], per-IMEI
  rename/release/start/stop/restart, and
  upload/download/tail/dev taking <imei|fleet_id>, with
  --log-file on tail and dev.
• The help footer lost the Targets paragraph and the removed flags.

Tests cover every command's wire shape against a fake server, the delete
confirmation with stdin swapped for a pipe (y, YES, n, bare enter, EOF),
path escaping of emails in the remove route, and argument validation.

Pairs with siliconwitchery/superstack-next#16; the version gate stays at
0.0.2 on both sides. The direnv dev-shell commit already on dev rides
along, and dev was rebased onto main to drop the pre-squash auth commit
it still carried.