fix(cli): hand over a working URL after the service install

Onboarding that installed the background service ended at "You are all
set!" without printing the server address or opening a browser - both
lived only in the foreground-start path. The authenticated tail also
told the user "Next: paperclipai run" while the service was already
running the server.

Add announceServiceReady: wait for the service to answer health, print
the URL, open the browser on interactive terminals, and point at
service status/logs when it never answers. Wire it into both onboard
call sites and correct the authenticated next-steps tail for the
service case.

cli/package.json

@@ -56,6 +56,7 @@
     "dotenv": "^17.4.2",
     "commander": "^13.1.0",
     "embedded-postgres": "^18.1.0-beta.16",
+    "open": "^11.0.1",
     "picocolors": "^1.1.1"
   },
   "devDependencies": {