fix(hub): print direct local login link on startup

[Sun-sunshine06]

Summary

Print a direct local login link when HAPI Hub starts, and update CLI guidance to point users to that startup output.

Why

When HAPI Hub is opened remotely or through a browser on another device, it can be inconvenient to manually find the access token in local config files.
A startup login URL makes first-time access much easier.

Changes

• print a local login URL on hub startup
• extract direct-access URL helpers into a small utility
• add unit tests for tokenized URL generation
• update CLI auth/token help text to mention the startup login URL

Notes

• this keeps the change scoped to discoverability and onboarding
• no runtime auth flow is changed

Testing

• cd hub && bun test src/utils/directAccess.test.ts
• bun typecheck

[github-actions]

Findings

• [Major] Startup log now prints tokenized login URL every run; CLI_API_TOKEN ends up in logs even when sourced from env/file. Evidence hub/src/index.ts:232
  Suggested fix:

  if (config.cliApiTokenIsNew || process.env.HAPI_LOG_TOKENS === 'true') {
      console.log('[Web] Login:  ' + localDirectAccessUrl)
  }

Summary

• Review mode: initial. 1 major issue: token logged each startup; gate behind opt-in or only on new token.

Testing

• Not run (automation)

[github-actions]

[MAJOR] Startup log prints tokenized login URL every run; CLI_API_TOKEN ends up in logs even when sourced from env/file. Evidence hub/src/index.ts:232.

Suggested fix:

if (config.cliApiTokenIsNew || process.env.HAPI_LOG_TOKENS === 'true') {
    console.log('[Web] Login:  ' + localDirectAccessUrl)
}