feat(cli): campus auth status — show stored token identity and scopes #45

Motivation

campus-cli tokens carry exactly the scopes requested at login (no accumulation — campus#865 / invariant A7), and the only way to discover a stored token's scopes today is to hit a 403 and re-login. Scripts and agents managing campus tasks (campus-cli#42) need a proactive way to answer "what can this token do?" before acting.

The data already exists locally: the login scope short-circuit (#38) compares stored vs requested scopes to decide whether to re-authenticate, so the credential store holds the token's scopes.

Proposed behavior

campus auth status prints:

• server / base URL and OAuth client id in use
• authenticated principal (user id / email, if resolvable)
• the scopes the stored token carries
• token age / expiry if the credential store records it, and whether a stored token is still valid (cheap authenticated ping, skippable with --offline)

Support --json for script/agent consumption.

Acceptance

• campus auth status prints client, server, principal, and scopes from the stored credential
• --json machine-readable output
• --offline skips any network validation
• README documents the command in the "Token scopes" workflow (check stored scopes before re-login)

Refs: #42 (campus user * scope expansion — agents), #38 (login scope short-circuit stores scopes), nyjc-computing/campus#865 (scoped admin users)