Add mosaic gateway login subcommand with meta.json URL default, config
rotate-token and recover-token subcommands for admin token minting via
BetterAuth session cookie, fix the bootstrapFirstUser dead-end when admin
exists but no token is on file, and add Vitest tests for all new flows.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>