feat(cli): add deployment mode prompts, auth bootstrap-ceo command, and doctor check

Extend server setup prompts with deployment mode (local_trusted vs
authenticated), exposure (private vs public), bind host, and auth config.
Add auth bootstrap-ceo command that creates a one-time invite URL for the
initial instance admin. Add deployment-auth-check to doctor diagnostics.
Register the new command in the CLI entry point.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

cli/src/commands/configure.ts

@@ -44,9 +44,15 @@ function defaultConfig(): PaperclipConfig {
       logDir: resolveDefaultLogsDir(instanceId),
     },
     server: {
+      deploymentMode: "local_trusted",
+      exposure: "private",
+      host: "127.0.0.1",
       port: 3100,
       serveUi: true,
     },
+    auth: {
+      baseUrlMode: "auto",
+    },
     storage: defaultStorageConfig(),
     secrets: defaultSecretsConfig(),
   };
@@ -124,7 +130,11 @@ export async function configure(opts: {
         config.logging = await promptLogging();
         break;
       case "server":
-        config.server = await promptServer();
+        {
+          const { server, auth } = await promptServer();
+          config.server = server;
+          config.auth = auth;
+        }
         break;
       case "storage":
         config.storage = await promptStorage(config.storage);