Add logout, passkey management, and a standalone login

The "auth routes" open question in GOALS.md conflated four unrelated
things once the upstream routes and controllers were checked: logout and
the passkey settings routes sit behind the same token_auth middleware as
everything else this crate wraps, login needs a credential exchange since
there's no token yet, refresh/refresh_react turned out to be the bulk
sync-dump endpoint already parked as a separate open question, and
connected_account is Gmail OAuth linking that belongs with Integrations.

Adds logout, list_passkeys, delete_passkey (passkey registration is left
out — it needs a WebAuthn ceremony a browser has to drive), and
InvoiceNinjaClient::login as an associated function returning a lean
LoginResponse that types only is_owner/is_admin/token and leaves the
server's much larger nested payload in extra.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

CHANGELOG.md

@@ -7,6 +7,21 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Added
+
+- Logout and passkey management: `logout`, `list_passkeys`, and
+  `delete_passkey`. `logout` regenerates every system-issued token on the
+  whole company, not just the caller's, so it ends every session sharing
+  it. Passkey *registration* is not wrapped — it needs a WebAuthn ceremony
+  only a browser can drive. Adds `Passkey`.
+- `InvoiceNinjaClient::login`, an associated function (not a method, since
+  there is no token yet to build a client with) that exchanges an email and
+  password for an API token, optionally with a one-time password for
+  two-factor accounts. Adds `LoginResponse` and `LoginCompanyUser`; the
+  nested company/user/account data the server also returns is left in
+  `extra` rather than modelled. Does not cover passkey login, SSO, or
+  `/login/precheck`.
+
 ## [0.2.0] - 2026-10-25
 
 ### Added