feat(cli): release pipeline

[atrsa]

Summary

Switch CLI auth from MCP OAuth (bearer tokens + refresh) to public API v2 OAuth (PKCE → persistent API key). Add release infrastructure for distributing standalone binaries.

Changes

• Replace MCP OAuth flow with /public/v2/oauth/ endpoints (authorize → callback → token → API key)
• Simplify credential storage: single API key in keyring instead of access/refresh token pair
• Remove set-env command and ENVIRONMENTS dict; use build-time _build_info.py for default API URL
• Add 401 handling with user-facing re-login message
• Add PyInstaller build script (scripts/build.py) with prod config injection
• Add GitHub Actions release workflow (macOS arm64/x86_64, Linux x86_64)
• Add Homebrew formula scaffold
• Add PR template
• Display record IDs with UI-matching prefixes (IN-136159, BI-420, etc.)
• Accept prefixed IDs in get commands (dualentry invoices get IN-136159)

Test plan

• Unit tests pass (uv run pytest)
• Linter passes (uv run ruff check .)
• Manually tested with dualentry <command>