1.0: Make auth and key errors accurate and correctly coded #1323

Goal: auth and key commands report the real cause of a failure and exit with the documented code.

• major: A failed refresh is reported as an expired grant and exits 1, even when the auth server was unreachable. src/cmd/auth.rs:177-210.
• minor: auth status describes a plane it never names, and contradicts itself. src/cmd/auth.rs:343, 1483-1495, 1752, 1806-1820, 1833.
• minor: Login on a handle that does not resolve exits 1 with an opaque sentence. src/cmd/auth.rs:678-705.
• minor: The plane refusal gives the wrong reason when this plane's session was deleted. src/cmd/auth.rs:76-107.
• minor: auth status drops the cause of a failed account selection. src/cmd/auth.rs:1524, 1764, 1837.
• minor: Comments say the plane is read once at login. src/config/account/mod.rs:86-91, src/cmd/auth.rs:562-566.
• minor: Comments still name auth switch. src/cmd/auth.rs:1843, src/config/account/selection.rs:762-763.
• minor: key add with no key sends a person to key create. src/cmd/key.rs:49-50, 1123-1126.
• minor: A missing .pub path gets a second .pub. src/cmd/key.rs:1061-1067.
• minor: --from-legacy counts sign-only records as covering a key. src/clients/git/ssh.rs:193-201.
• minor: Records that cannot push are reported as no keys. src/clients/git/ssh.rs:286-289, 513-519.
• minor: key create --dry-run skips the preflight and claims publish: true. src/cmd/key.rs:486-510.
• minor: The key delete lockout warning counts all records. src/cmd/key.rs:911, 927-931.
• minor: The same bad key exits 1 in key add and 2 in key delete. src/cmd/key.rs:574-578, 847-853, 1036-1056.
• minor: key create --dry-run --json has a different shape, and its private_key is a path. src/cmd/key.rs:168, 250-260, 499-506.