feat(login): add headless authentication

[caiopizzol]

What changed

• adds amp login --headless for remote environments;
• reads the localhost callback without terminal echo;
• accepts only the expected Ampersand callback; and
• points browserless users to the new command.

Why

Remote environments cannot receive the browser's localhost callback directly.

Tested

• Go test suite, vet, build, and golangci-lint 2.9.0
• Real Chrome login with a production-configured build
• Authenticated amp list:projects request
• Large callback input without truncation

Note

This reuses the existing callback, so it needs no backend change. The CLI hides the pasted value, but the callback remains in browser history.