Type the API payloads with @seamless-auth/types instead of Record<string, unknown>

[Bccorb]

Most of the CLI's API surface is typed as Json = Record<string, unknown>, with hand-written narrowing helpers doing the work a schema would do. fells-code/seamless-auth-types#4 publishes the real shapes, and since they are Zod schemas the CLI can parse responses rather than probing them field by field.

src/core/admin.ts:

• UserList is UsersListResponseSchema, UserDetail is AdminUserDetailResponseSchema, OrgList is AdminOrganizationListResponseSchema, MemberList is OrganizationMembersResponseSchema.
• DeviceReplacementOptions is DeviceReplacementRecoverySchema, and the response is DeviceReplacementRecoveryResponseSchema.
• The arr() helper and the orgEnvelope / membershipEnvelope unwrappers exist because the payloads are untyped; parsing with the schema replaces both.

src/core/systemConfig.ts:

• SystemConfig = Record<string, unknown> is SystemConfigSchema, and OAuthProvider = Record<string, unknown> is OAuthProviderConfigSchema. diffConfig currently walks arbitrary keys, so typing the config would also let it flag a key the server does not recognize.
• PatchResult is UpdateSystemConfigResponseSchema.

src/core/sessions.ts: SessionInfo plus toSessionInfo/str are a hand-rolled parser for SessionSchema. Note the local type has lastUsedAt and expiresAt optional while the api declares them required, so one of the two is wrong.

src/core/loginFlow.ts: LoginChannel and src/core/config.ts's IdentifierType are both IdentifierTypeSchema. StartedLogin.loginMethods is string[] where the api returns LoginMethod[].

Staying local, since none of it crosses a service boundary: TokenBundle and the keychain backends, Profile and SeamlessConfig, the template registry types, ApiResponse, and the PortalApp / PortalDatabase shapes (those belong to seamless-portal-api, not the auth API).