fix(connect): label the sign-in code and say where the signup email came from - #485

Tracking

• VOL-1535 (CLI part: label the printed code)
• VOL-1652

Why

• Browser sign-in printed Code: ABCD-EFGH with no label. A coding agent reading that output can take an unlabelled token for an API key and stop (VOL-1535).
• volcano connect --signup silently used the global git email for signup. A signed-out user saw their address appear with no explanation (VOL-1652).

Summary

• Browser login and signup now print One-time sign-in code (not a secret): ABCD-EFGH instead of Code: ABCD-EFGH. This is the OAuth user code the approval page shows, not the device code or a token.
• When connect --signup takes the address from git config --global user.email (no --email), it prints a note: "The signup link includes , your git config --global user.email. You can sign up with any address on the signup page." No note when --email is given. The address shows up in the printed signup link, which is where the user sees it.
• The note goes to connect's log writer, which is stderr under --json, so JSON stdout is unchanged. The --json result shape is unchanged.
• docs/connect.md describes the labelled code, how it differs from the dashboard prompt's --device-code (which is a secret), and the git-email note.
• deferred: whether the web signup page should prefill and explain the address (it ignores the email parameter today).
• Out of scope: the dashboard setup prompt's inline --device-code (VOL-1535's web part, another PR).

Verification

• make check (openapi-generated-check, release-workflow-check, golangci-lint 0 issues, make test all packages ok)
• go build ./..., make build FIRST_PARTY_DEVICE_CLIENT_ID=volcano-cli, ./volcano --version
• Shared docs lint from Kong/volcano-docs (scripts/lint-docs.mjs docs): OK
• New test TestConnectSignupSaysTheEmailCameFromGit (text and --json: note on the log stream only); TestConnectSignupUsesEmailFlagOverARelayGitEmail now asserts no note with --email; auth_test asserts the new label.
• The volcano-web signup page at main (3c319ac16) reads only next and ref, not the email the CLI sends, so the note does not claim the page prefills it or that the account uses it.
• Independent pr-review and team-review; their P2s (note wording, user code vs dashboard device code) are fixed in the last commit.