DAH-2585: fail lium fund non-zero when the coldkey will not unlock

[arhangel66]

Follow-up to #99, which was merged before the second review pass landed. Two review comments, both on the TAO path of lium fund.

• A wrong coldkey password exited 0. The unlock block added in DAH-2585: unlock coldkey before the fund spinner hides its password prompt #99 did ui.error(...) plus a bare return; ui.error only prints, so handle_errors never saw a failure and click exited successfully. lium fund && lium up therefore treated a failed top-up as a completed one. It now raises CliFailure("coldkey_unlock_failed", ..., EXIT_CONFIGURATION_ERROR), matching wallet_load_failed and invalid_amount in the same function. This is the exact anti-pattern DAH-2593 (DAH-2593: stop the CLI Action layer from swallowing errors #104) removed from the Action layer — the new block reintroduced it in one spot. The alpha path was already correct (it raises LiumError).
• The password was asked before the amount prompt and the confirm, so a user who backed out had already typed it. The amount prompt, the balance spinner and the confirm now run first; the unlock and the registration spinner moved below the confirm. Nothing backend-mutating happens until the user confirms.
• DAH-2585: unlock coldkey before the fund spinner hides its password prompt #99's fix is intact. The unlock still runs outside every spinner and still immediately precedes CheckWalletRegistrationAction, the only coldkey-signing step — Lium.add_wallet reads bt_wallet.coldkey, which is what triggers bittensor's raw password prompt. The one spinner now ahead of it, ui.load("Loading balance"), never touches the coldkey and so cannot hide a prompt. The guard test was retightened to state that invariant precisely instead of "unlock is the first event".

Tests: test_fund_tao_unlock_failure_aborts now asserts the exit code, and test_fund_tao_declined_confirm_never_asks_for_the_password is new. Both fail against main and pass here. uv run pytest test/test_fund_cli.py -q → 53 passed. Full suite: 11 pre-existing failures, identical on an untouched tree.

No version bump — this needs to ride the next release.

• The reorder also moved wallet registration behind the confirm, which is not a read-only step: for a coldkey the backend has not seen, CheckWalletRegistrationAction -> Lium.add_wallet posts /tao/create-transfer and /token/verify and binds the wallet to the account. Before, lium fund -w new_wallet bound the wallet even when the user then declined at the confirm; now declining leaves the account untouched. Side effect of the same move: the first network call is balance(), so a broken API key no longer costs the user a password prompt first.

A review pass on this branch found the renamed guard test had been weakened — events.index(...) comparison alone still passes if the unlock is wrapped in a spinner of its own, which is the exact failure #99 fixed. _spy_ui_load now records spinner exits too and the test asserts no spinner is open when the prompt goes up. Verified by mutation: wrapping the unlock in ui.load("Unlocking coldkey", ...) fails the test, and passed it before the change.