Summary

Three related changes that share a branch:

• `anvil repo list` — new subcommand. `GET /{org}/repos`, table or `–json`. Mirrors `repo create`’s org resolution: explicit `–org` or org from default repo / git remote.
• `auth login` token validation — login now hits `GET /api/v1/users/me` with the new token instead of pinging the unauthenticated `/health` endpoint, so a bad or expired token is rejected before it gets saved.
• `auth login` device flow — default flow is now OAuth 2.0 device authorization grant (RFC 8628). CLI requests a device code, opens the verification URL, polls `/api/v1/oauth/token` until the user approves. `–token` still works for non-interactive (CI) setups.

Companion server PR: fangorn/anvil#146. That has to deploy before this is useful — the device-flow + `/users/me` endpoints don’t exist on prod yet.

Test plan

• `cargo test` (50 passing, 7 new for the poll-state machine)
• `anvil repo list` against the default repo’s org
• `anvil repo list –org fangorn –limit 5`
• `anvil –json repo list`
• After server #146 lands: `anvil auth logout && anvil auth login` → expect browser to open the consent page, code shown, login succeeds
• `anvil auth login –token ` → expect a “token rejected” error, no config saved

🤖 Generated with Claude Code