fix: isolate inline OAuth credential caches

[ryanduguid]

Summary

• scope inline OAuth token-cache entries to their client ID instead of sharing _inline
• add logout --client-id and remove the unsafe legacy inline entry during inline logout
• remove cached tokens when profiles are removed or force-replaced
• document and test the inline credential lifecycle

Pre-existing _inline entries cannot be safely associated with a client ID, so inline users are deliberately required to authenticate again after this change. Named/default profile behavior is unchanged.

Validation

• npm test (10 files, 143 tests)
• npm run build
• npx tsc --noEmit
• git diff --check HEAD^ HEAD