#133 Add PDS authentication via com.atproto.server.createSession

Auth flow complete: XrpcClient::login() calls createSession, LoginCommand handles password from env/stdin with validation, mock transport tests cover success + 401. Session persistence (save_session/load_client) is tracked by #9.