feat(cli): add Platform login for Experiential Cloud

[kfallah]

Summary

• Make Experiential Cloud the first provider in interactive setup.
• Open the Platform /cli/auth approval flow when no Cloud credential is available.
• Receive and validate the xpl_ key over an ephemeral loopback callback, then persist it through the existing user-local auth store.
• Document interactive, preview, headless, and CI setup paths.

Validation

• uv run --extra dev ruff check .
• uv run --extra dev ruff format --check .
• uv run --extra dev ty check exp
• uv run --extra dev python -m pytest -q exp/cli/providers/experiential_cloud_test.py exp/cli/providers/provider_picker_test.py exp/cli/providers/setup_test.py exp/cli/gateway/setup_test.py exp/cli/optimize/router_candidates_test.py::test_router_candidate_picker_discovers_only_eligible_completion_models (99 passed)
• Installed-wheel smoke test passed.

The live Platform flow is exercised with a local callback fixture; no real credential was minted during tests.

[greptile-apps]

Greptile Summary

The PR adds browser-based Experiential Cloud authentication to interactive provider setup and makes the hosted provider the first picker option.

• Starts an ephemeral loopback callback listener and validates callback state and xpl_ key shape.
• Opens Platform approval, falls back immediately to masked credential entry when browser launch fails, and stores successful credentials in the existing user-local auth store.
• Updates provider ordering, setup tests, release coverage, environment examples, and documentation for interactive, preview, headless, and CI usage.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains; both previously reported issues are addressed by callback key-shape validation and the immediate browser-failure fallback.

Important Files Changed

Filename	Overview
exp/cli/providers/experiential_cloud.py	Adds the loopback browser-login flow and now rejects malformed callback keys while returning immediately when browser launch fails.
exp/cli/providers/provider_picker.py	Places Experiential Cloud first and integrates Platform login ahead of the existing masked credential prompt.
exp/cli/providers/experiential_cloud_test.py	Covers callback authorization, malformed callback rejection, credential secrecy, successful browser approval, and browser-unavailable fallback.
exp/cli/providers/provider_picker_test.py	Updates picker-order expectations and verifies that browser-approved Cloud credentials enter the existing setup and storage flow.

Sequence Diagram

sequenceDiagram
    actor User
    participant CLI
    participant Callback as Loopback callback
    participant Platform
    participant Store as User auth store
    CLI->>Callback: Bind ephemeral 127.0.0.1 port
    CLI->>Platform: Open /cli/auth with port and state
    User->>Platform: Approve CLI key
    Platform->>Callback: Return xpl_ key and matching state
    Callback-->>CLI: Release validated key
    CLI->>Platform: Discover models using key
    CLI->>Store: Persist credential
    alt Browser cannot open
        CLI-->>User: Show URL and masked-paste fallback
    end

Loading

_{Reviews (2): Last reviewed commit: "fix(cli): harden Platform login fallback" | Re-trigger Greptile}