Support headless login with --no-open

[ryanduguid]

Summary

• add xero login --no-open to print the OAuth authorisation URL without launching a browser
• preserve the existing browser-opening behaviour by default
• document SSH port forwarding for the localhost callback on remote and headless machines
• cover the command wiring and both OAuth launch modes with tests

Closes #7.

Verification

• npm test (133 tests)
• npm run build
• node bin/run.js login --help
• git diff --check origin/main...HEAD

Risks and limitations

• A live Xero OAuth sign-in was not exercised because it requires a configured Xero app and account.
• --no-open remains an interactive PKCE flow; it does not add device-flow or service-account authentication.
• The repository does not define a lint command.

[ryanduguid]

These XeroAPI PRs are ready for review when someone has time:

• Support headless login with --no-open #42 (this PR): headless login with --no-open.
• fix(accounting)!: correct RECEIPT contract and document namespaced TaxNumberType Xero-OpenAPI#846: corrects the RECEIPT linked-transaction contract and documents the namespaced TaxNumberType values. Its branch is behind master; I can update it when you're ready to merge.
• fix: deserialize namespaced TaxNumberType and RECEIPT linked transactions xero-python#243: the matching SDK fix, so those responses deserialise.

Each description lists its checks.