Hub CLI: login/whoami/push/pull/quota for spikeforge-hub

[w4ffl35]

Context

spikeforge-hub-api (https://github.com/capsize-games/spikeforge-hub-api)
exists and its API is stable: POST /v1/auth/login, PAT issuance via
POST /v1/tokens, the two-phase upload (POST /v1/uploads →
PUT /v1/uploads/{id}/content → POST /v1/uploads/{id}/commit), and
GET /v1/models, GET /v1/me for quota. See that repo's README for the
exact request/response shapes.

What's needed

A new spikeforge_hub/client.py — a thin HTTP client wrapping that API with
PAT auth (Authorization: Bearer sfh_pat_...), kept in the spikeforge-hub
distribution rather than as a new distribution (mirrors this project's
existing "extend, don't multiply distributions" preference — see
spikeforge_hub/registry.py's own docstring making the same call about the
governance layer).

Then spikeforge_hub/cli.py grows subcommands:

• spikeforge-hub login — prompt for a PAT (paste), or open the loopback
  flow once [PT-W2] Encode-at-inference contract #3 in spikeforge-hub-api exists. Store it wherever this repo
  already keeps local config (check for a precedent before inventing one).
• spikeforge-hub whoami — GET /v1/me, print handle/email/quota.
• spikeforge-hub push <name> --version <v> --license <spdx> — build a
  .spkf from a saved model (reuse spikeforge/serving/bundle.py::build,
  the same function server/bundle_routes.py already calls), then run the
  full two-phase upload against it.
• spikeforge-hub pull @handle/slug[@version] — download and import through
  the existing inspect → compat → promote funnel
  (spikeforge_hub/import_model.py), once the previous issue's community
  source case lands in downloads.py.
• spikeforge-hub quota — render GET /v1/me's storage block.

Depends on

The other open issue in this repo ("Model hub: accept source: "community"
and consume the hosted index") for pull. push and login/whoami don't
depend on it and can land first.

Tests

This repo's existing CLI tests are the pattern to follow — check
spikeforge_hub/registry_cli.py's test file for the harness style rather
than inventing a new one.

[w4ffl35]

Depends on: spikeforge#46 for the pull subcommand's community source case. push/login/whoami don't depend on it.