Add durable Paseo Hub CLI login (#3022)

* feat(cli): add durable Hub login

Keep organization-scoped human credentials separate from daemon relationship authority. Connect now exchanges explicit or stored CLI authority for a one-time enrollment token, while logout removes human access without implicitly disconnecting automation.

* fix(cli): require TLS for remote Hub credentials

Durable Hub credentials are bearer secrets, so remote origins must not receive them over cleartext HTTP. Keep literal loopback HTTP available for local Hub development.

* fix(cli): make Hub destinations explicit

Resolve optional Hub origins through one shared precedence policy so active logins remain the default context and credentials stay origin-bound. Report the selected destination before human-facing work, keep structured output auditable, and preserve login authority until requested daemon disconnection succeeds.

public-docs/hub/index.md

@@ -54,3 +54,12 @@ A project is one set of environments and triggers. Split your work into projects
 ## Running it
 
 Two ways: [hosted](/docs/hub/hosted) or [self-hosted](/docs/hub/self-hosting). Everything above is the same either way.
+
+Once Hub is running, approve durable CLI access and inspect the organization:
+
+```sh
+paseo hub login https://hub.example.com
+paseo hub projects
+```
+
+The login is scoped to that exact Hub origin. Use it to connect a daemon or deploy configuration without copying an API key into each command.