fix(auth): validate resolved credentials in status checks

[stephendolan]

Summary

Authentication status now reports working YNAB_API_KEY credentials the same way as keychain credentials, while rejecting invalid tokens through a lightweight YNAB user lookup. Credential rotation refreshes the cached client, and network or rate-limit failures remain operational errors instead of being mislabeled as invalid authentication.

Validation covered valid keychain and environment credentials, invalid environment credentials, missing credentials, CLI and MCP serialization, transient failures, and token non-disclosure. Both Bun and Vitest passed all 45 tests, with typecheck, lint, build, and package dry-run also passing.

Problem

ynab auth status and MCP check_auth only inspected keychain storage, so a successfully working YNAB_API_KEY still appeared unauthenticated.

Post-Deploy Monitoring & Validation

• Confirm ynab auth status and MCP check_auth return true for valid keychain and environment credentials, and false for invalid credentials.
• Treat environment credentials still reporting false, tokens appearing in output, or transient API errors being reported as invalid credentials as release failures.
• Verify the GitHub release and npm package at v2.8.3; roll back the release if those checks fail.