feat(tunnel): auto-relogin on session_expired during first connect

When the initial tunnel connection fails with session_expired (dead or
invalid refresh token), the CLI previously printed "please run
`ankimcp --login`" and exited, forcing a manual re-auth. Now, in an
interactive tunnel session, it runs the existing device-flow login
automatically and retries the connection once.

Behavior:
- On a first-connect session_expired, if stdout is a TTY and no relogin
  has been attempted yet, run performLogin (prints URL + code, opens
  browser, polls, saves creds) and retry connect() once with the fresh
  credentials.
- Single-shot: a second session_expired, a failed login, a non-TTY run,
  or any other error falls back to the previous error-and-exit. No loop.
- Scope is first-connect only; the mid-session error-event path is
  unchanged. TunnelClient is untouched — this lives entirely in the
  command layer.

Also extract the duplicated device-flow error reporting into a shared
reportLoginError(cli, error) helper, now used by handleLogin,
ensureCredentials, and the relogin path.

Tests: fix the now-stale ../perform-login module mocks to export
reportLoginError; add coverage for relogin success, single-shot bound,
login-failure, non-TTY gate, non-session errors, and reportLoginError.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: anatoly314

src/tunnel/commands/__tests__/login.command.spec.ts

@@ -1,10 +1,38 @@
 // Mocks must be declared before module imports that depend on them.
-jest.mock("../perform-login", () => ({
-  performLogin: jest.fn(),
-  translateDeviceFlowError: jest.fn(
+//
+// `reportLoginError` is now imported by `login.command.ts`, so the factory MUST
+// export it — otherwise it resolves to `undefined` and the catch path throws
+// `TypeError: reportLoginError is not a function`. We give it a real-ish stub
+// that mirrors production (DeviceFlowError → translated line via the SAME
+// `translateDeviceFlowError` jest.fn the tests spy on; otherwise the generic
+// `Login failed: <msg>` line with the Error forwarded as the 2nd arg). This
+// keeps the existing `mockedTranslate.toHaveBeenCalledWith` / `cli.error`
+// assertions valid while exercising the new symbol.
+jest.mock("../perform-login", () => {
+  const translateDeviceFlowError = jest.fn(
     (err: { message: string }) => `translated: ${err.message}`,
-  ),
-}));
+  );
+  return {
+    performLogin: jest.fn(),
+    translateDeviceFlowError,
+    reportLoginError: jest.fn(
+      (
+        cli: { error: (msg: string, err?: unknown) => void },
+        error: unknown,
+      ) => {
+        const { DeviceFlowError } = jest.requireMock("@/tunnel");
+        if (error instanceof DeviceFlowError) {
+          cli.error(translateDeviceFlowError(error as { message: string }));
+        } else {
+          cli.error(
+            `Login failed: ${error instanceof Error ? error.message : String(error)}`,
+            error instanceof Error ? error : undefined,
+          );
+        }
+      },
+    ),
+  };
+});
 
 jest.mock("@/tunnel", () => {
   class DeviceFlowError extends Error {

src/tunnel/commands/__tests__/perform-login.spec.ts

@@ -1,4 +1,8 @@
-import { performLogin, translateDeviceFlowError } from "../perform-login";
+import {
+  performLogin,
+  reportLoginError,
+  translateDeviceFlowError,
+} from "../perform-login";
 import {
   CredentialsService,
   DeviceFlowError,
@@ -73,6 +77,58 @@ describe("translateDeviceFlowError", () => {
   });
 });
 
+describe("reportLoginError", () => {
+  let cli: jest.Mocked<Cli>;
+  let exitSpy: jest.SpyInstance;
+
+  beforeEach(() => {
+    cli = makeStubCli();
+    // Spy as a no-op (NOT a throw): reportLoginError must only PRINT, never
+    // terminate the process. If it ever called exit, the assertions below
+    // would catch it without killing the Jest worker.
+    exitSpy = jest
+      .spyOn(process, "exit")
+      .mockImplementation((() => undefined) as never);
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it("renders a DeviceFlowError via translateDeviceFlowError (single message arg)", () => {
+    const err = new DeviceFlowError("denied", "access_denied");
+
+    reportLoginError(cli, err);
+
+    // Exact wording the real translateDeviceFlowError produces for this code —
+    // pins that reportLoginError delegates to it for DeviceFlowErrors.
+    expect(cli.error).toHaveBeenCalledTimes(1);
+    expect(cli.error).toHaveBeenCalledWith(
+      "Authentication was denied. Please try again with 'ankimcp --login'",
+    );
+    // The DeviceFlow branch passes no second (Error) argument.
+    expect(cli.error.mock.calls[0]).toHaveLength(1);
+    expect(exitSpy).not.toHaveBeenCalled();
+  });
+
+  it("renders a generic Error as `Login failed: <msg>` with the Error forwarded as 2nd arg", () => {
+    const err = new Error("boom");
+
+    reportLoginError(cli, err);
+
+    expect(cli.error).toHaveBeenCalledTimes(1);
+    expect(cli.error).toHaveBeenCalledWith("Login failed: boom", err);
+    expect(exitSpy).not.toHaveBeenCalled();
+  });
+
+  it("stringifies a non-Error value and forwards no Error argument", () => {
+    reportLoginError(cli, "weird");
+
+    expect(cli.error).toHaveBeenCalledWith("Login failed: weird", undefined);
+    expect(exitSpy).not.toHaveBeenCalled();
+  });
+});
+
 describe("performLogin", () => {
   let credentialsService: jest.Mocked<CredentialsService>;
   let deviceFlowService: jest.Mocked<DeviceFlowService>;