Support Personal Access Token exchange

[patrickposner]

Summary:

• Exchange Static Studio Personal Access Tokens through the access-token Edge Function and use the returned session token for Supabase calls.
• Preserve legacy Supabase session token pair support while rejecting Personal Access Tokens combined with refresh tokens.
• Update CLI help and docs with PAT generation, subscription requirements, and no-refresh-token guidance.

Tests:

• npm run typecheck
• npm test
• npm run build