//! Auth helpers that are usable by both the CLI flow (`src/cli/auth.rs`) and
//! the in-TUI sign-in wizard. Keeps the device-code state machine free of
//! `println!`s so the TUI can drive it via channels.
//!
//! These helpers are deliberately additive: the existing `cli::auth::login`
//! is not refactored to use them (yet) to keep the change focused. A follow-up
//! can consolidate.
/// Mask an API key for display. Keys with 16+ characters render as
/// `<first-4>****<last-4>`; shorter keys render as `****`. Used by both the
/// CLI sign-in success line and the TUI signed-in home.