fix: fail closed when API key region detection is inconclusive

[NianJiuZst]

Summary

• fail closed when neither API region can be confirmed
• classify probes as authorized, unauthorized, unreachable, or inconclusive
• never return or persist a guessed global fallback
• honor an explicit --region global|cn during API-key login
• reject saving only when the selected endpoint explicitly returns 401/403
• warn and save the user's explicit region when validation is unavailable

Root cause

Region detection collapsed invalid credentials, blocked probes, and transient network failures into a successful global result. Callers then persisted that unverified result, overwriting a valid China-region configuration and routing later requests to the wrong API host.

The explicit-region recovery path still treated every validation exception as an authentication failure, so a blocked quota endpoint produced the same result as a rejected key.

Impact

Automatic detection remains fail-closed and leaves existing credentials unchanged when no region can be confirmed. Explicitly selecting a region now treats the user's choice as authoritative: confirmed 401/403 responses still reject the key, while network failures produce a warning and save the selected region so restricted-network users have a real recovery path.

Test reliability

Config command tests now use scoped spies or dry-run behavior instead of process-wide module mocks, preventing them from replacing the config loader used by login tests.

Fixes #191

Validation

• bun test — 381 passed
• targeted region and login tests — 15 passed
• bun run typecheck
• bun run build:dev
• ESLint on all changed TypeScript files
• git diff --check