Move config to ~/.ellipsis, friendly auth errors, connect UI cleanups

[hbrooks]

What

Config: ~/.ellipsis replaces ~/.config/ellipsis

A user hit first-run EACCES because their ~/.config was root-owned (leftover from an old sudo install). The CLI now creates its own directory directly under $HOME, so it can never inherit broken ownership.

• ELLIPSIS_CONFIG_DIR still overrides, and the spool/hooks dirs move with it (now derived from the shared configDir()).
• A config at the legacy ~/.config/ellipsis/config.json is read as a fallback so existing logins survive; the first write lands it in ~/.ellipsis. An unreadable legacy file (the root-owned case) is skipped instead of crashing.

Auth errors

• runAction maps 401 ApiErrors to a re-login hint instead of echoing the raw HTTP failure, with a distinct message when the rejected token came from ELLIPSIS_API_TOKEN (env outranks the config file, so agent login alone would not fix it).
• agent me calls requireToken() before hitting GET /v1/me, so a missing credential fails fast with the login hint instead of sending an unauthenticated request.

Connect UI

• The top banner (brand + version, session URL, model) is gone; session identity now lives in the footer meta line as status · $X total (Last step: $Y) · <session id, hyperlinked to the dashboard> · <model> · v<version>.
• The "live stream unavailable (…) — polling for updates" notice is no longer shown: the polling fallback keeps the transcript current, so the degradation is invisible and not worth announcing. Real stream errors still surface.

Help

• Subcommands are listed alphabetically in --help (configureHelp({ sortSubcommands: true })).

Testing

• vitest run: 246 passed, including new coverage for the legacy-config fallback (mocked homedir) and the 401 message mapping.
• tsc --noEmit clean.
• Drove the real CLI: agent me with no token fails fast without a network call; a legacy config is read and migrated to ~/.ellipsis on first write; 401s from a stub server print both friendly variants.