fix(pwa): the CLI hint printed commands that no longer run

The "Connect the CLI" card handed out:

    LOGICSRC_API=https://app.logicsrc.com logicsrc login
    logicsrc teams push <team> prod --env .env
    logicsrc teams pull <team> prod --env .env

Two things are wrong with that, and both survived a release.

Since #109 addressed vaults as <team> <project> <env>, push and pull take
three positionals. The hint passes two, so pasting it exits with a missing-
argument error -- the card is not merely stale, it is broken.

The LOGICSRC_API prefix sets the variable to the value the CLI already
defaults to (DEFAULT_API_URL, #107), so on the hosted app it does nothing
while reading like a required step. It is now emitted only when the origin
is not the default, which is the case it exists for: self-hosting.

`--env .env` is dropped for the same reason -- it restates the option's own
default, and sitting next to the new <env> positional it made one flag and
one argument look like the same thing.

Same stale two-argument form fixed in the post-install hint (install.sh) and
the accept-invite message, and in the empty-vault-list prompt on the card.

CLI_HINT moves to src/lib/cli-hint.mjs so a test can assert on the rendered
commands without standing up express and the database, matching how the
other lib-level views are covered. The tests pin the argument count rather
than the prose: restyling the card stays free, dropping an argument does not.

apps/pwa: 13/13 pass.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

apps/pwa/test/cli-hint.test.mjs

@@ -0,0 +1,51 @@
+// The dashboard's "Connect the CLI" card kept printing commands that no longer
+// ran. It survived two releases of drift: `logicsrc teams push <team> prod` is
+// two positionals, and since vaults became <team> <project> <env> the CLI exits
+// with a usage error on paste. It also told everyone to set LOGICSRC_API to the
+// value the CLI already defaults to, which reads like a required step.
+//
+// A card that hands out commands is only useful if the commands run, so these
+// pin the shape rather than the prose -- restyling the card is free, quietly
+// dropping an argument is not.
+import assert from "node:assert/strict";
+import test from "node:test";
+
+import { CLI_HINT } from "../src/lib/cli-hint.mjs";
+
+/** The commands themselves, with the entities decoded back to real syntax. */
+const commands = (origin) =>
+  CLI_HINT(origin)
+    .match(/margin:0">([\s\S]*?)<\/pre>/)[1]
+    .replace(/&lt;/g, "<")
+    .replace(/&gt;/g, ">")
+    .split("\n");
+
+const HOSTED = "https://app.logicsrc.com";
+
+test("push and pull carry all three vault positionals", () => {
+  for (const verb of ["push", "pull"]) {
+    const line = commands(HOSTED).find((l) => l.includes(`teams ${verb}`));
+    assert.ok(line, `no teams ${verb} line`);
+    assert.match(line, /teams (push|pull) <team> <project> <env>/);
+    // Guards the specific regression: two positionals used to be enough.
+    // Drop "logicsrc teams <verb>" and count only what follows.
+    const args = line.split("#")[0].trim().split(/\s+/).slice(3);
+    assert.equal(args.length, 3, `teams ${verb} needs 3 args, got ${args.join(" ")}`);
+  }
+});
+
+test("the local .env path is left at its default", () => {
+  // `--env <path>` defaults to .env in the CLI. Spelling it out next to the
+  // <env> positional made two unrelated things look like one.
+  assert.ok(!commands(HOSTED).some((l) => l.includes("--env")));
+});
+
+test("the hosted origin needs no LOGICSRC_API prefix", () => {
+  const login = commands(HOSTED).find((l) => l.includes("logicsrc login"));
+  assert.equal(login, "logicsrc login");
+});
+
+test("a self-hosted origin still gets the prefix", () => {
+  const login = commands("http://localhost:8080").find((l) => l.includes("logicsrc login"));
+  assert.equal(login, "LOGICSRC_API=http://localhost:8080 logicsrc login");
+});