feat(acp): surface bridge auth failure in the UI with fallback / fix-auth (R17)

When the bridged `claude` can't authenticate (detached daemon / no keychain),
the turn returns "Not logged in" instead of a real answer. Rather than silently
relay that, detect it and let the user choose.

- Driver: detect a "Not logged in"-only turn and write a cross-process signal
  (fusion-acp-bridge-auth.json); a real response clears it (acp-driver test).
- Dashboard status: GET /providers/claude-cli/status reports
  acp.authFailed + authReason from the signal.
- UI: the Claude CLI provider card shows an auth-failure banner with
  "Use claude -p" (sets experimentalFeatures.claudeCliAcp=false) and
  "I fixed auth — re-test", plus a fix hint (run `claude` to log in).
- Enable resolution now recomputes each call with an operator force-override
  (FUSION_CLAUDE_ACP_FORCE), so the "Use -p" fallback takes effect on the next
  turn — no restart. claude-acp-enable tests updated.

pi-claude-cli + engine tests green; dashboard typecheck clean.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

packages/dashboard/app/api/legacy.ts

@@ -1674,6 +1674,18 @@ export interface ClaudeCliStatus {
     reason?: string;
   } | null;
   ready: boolean;
+  /** Route A ACP transport state (Claude CLI via the claude-code-cli-acp bridge). */
+  acp?: {
+    /** experimentalFeatures.claudeCliAcp (default ON). */
+    enabled: boolean;
+    /** The acp-runtime plugin published a bundled bridge path. */
+    bridgeAvailable: boolean;
+    /** Claude CLI is actually routing through the bridge (enabled + flag + bridge). */
+    active: boolean;
+    /** The bridged `claude` returned "Not logged in" — needs fallback or re-auth (R17). */
+    authFailed: boolean;
+    authReason?: string;
+  };
 }
 
 export interface DroidCliStatus {