fix(api): tell agents not to hunt for the instance URL in CLI login guidance

A rerun with the guidance answered correctly but spent four minutes looking
for the instance address. The person already knows it from their browser.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/src/__tests__/cli-auth-terminal-guidance.test.ts

@@ -15,6 +15,7 @@ describe("CLI terminal login guidance in the agent API catalog", () => {
     expect(challenge, query).toBeDefined();
     expect(challenge!.description).toContain("`npx paperclipai auth login --api-base <this Paperclip URL>`");
     expect(challenge!.description).toContain("never by an agent on their behalf");
+    expect(challenge!.description).toContain("leave it as that placeholder instead of looking it up");
     expect(challenge!.description).toMatch(/never hand out an agent key, create or approve a challenge yourself, or ask for the person's password/);
   });
 

server/src/routes/openapi.ts

@@ -7412,7 +7412,7 @@ registry.registerPath({
   path: "/api/cli-auth/challenges",
   tags: ["access"],
   summary: "Connect a person's terminal to Paperclip: create a CLI auth challenge for terminal login",
-  description: "Called by the Paperclip CLI in a person's own terminal, never by an agent on their behalf. To connect someone's terminal to Paperclip as themselves, tell them to run `npx paperclipai auth login --api-base <this Paperclip URL>` in that terminal (add `--company-id <companyId>` to name the company). The CLI prints an approval link; they open it in a browser where they are signed in, review the requesting command, company and Board access, and approve. Only that CLI receives the resulting Board credential. `npx paperclipai auth whoami` confirms who it is signed in as and `npx paperclipai auth logout` revokes it. Agent API keys are a separate identity: never hand out an agent key, create or approve a challenge yourself, or ask for the person's password in chat.",
+  description: "Called by the Paperclip CLI in a person's own terminal, never by an agent on their behalf. To connect someone's terminal to Paperclip as themselves, tell them to run `npx paperclipai auth login --api-base <this Paperclip URL>` in that terminal (add `--company-id <companyId>` to name the company). The URL is the address the person already opens Paperclip at in their browser; leave it as that placeholder instead of looking it up, because addresses an agent can see (such as a runner-local API URL) may not be reachable from the person's machine. The CLI prints an approval link; they open it in a browser where they are signed in, review the requesting command, company and Board access, and approve. Only that CLI receives the resulting Board credential. `npx paperclipai auth whoami` confirms who it is signed in as and `npx paperclipai auth logout` revokes it. Agent API keys are a separate identity: never hand out an agent key, create or approve a challenge yourself, or ask for the person's password in chat.",
   request: { body: jsonBody(createCliAuthChallengeSchema) },
   responses: { 200: r.ok(), 400: r.badRequest },
 });