Finish the local browser import experience

[IlyaasK]

What

• hands a completed local browser import back to the originating dashboard operation
• displays Managed Auth usage, plan maximum, and remaining new-connection capacity
• constrains only net-new connections; existing imported connections remain refreshable at capacity
• shows a four-stage elapsed-time progress bar during preparation, upload, profile apply/save, and completion
• exits the connector flow once the durable API queue starts, allowing its Terminal tab to close
• reports imported/skipped browser-data counts and preserves partial storage results

This is the CLI finished-experience layer for KERNEL-1975.

Why

The customer must understand how many Managed Auth connections their plan permits and must see that a multi-minute server apply is progressing. Once the API owns durable post-import authentication, the local CLI should not remain open while that background queue runs.

How

• reads the merged max_auth_connections and auth_connections_used organization-limit fields exposed by the current API/SDK
• distinguishes unlimited, known-zero, positive, and temporarily unknown capacity
• classifies existing connections before applying capacity to net-new selections
• keeps create-time API quota enforcement authoritative for races
• advances an honest coarse progress bar only at completed client/server milestones
• treats finishing_managed_auth as a successful dashboard handoff phase

The latest published Go SDK does not yet expose connections_used on /org/entitlements; using the generated /org/limits fields avoids a hand-written HTTP path while preserving the merged entitlement values.

Deployment

Stacked on #229. Merge only after kernel/kernel#3453 is deployed, then publish and verify the Homebrew CLI before enabling the dashboard consumer.

Verification

• go test ./cmd ./internal/browserimport -run 'Test(ProfileImportProgress|ManagedAuth|ChooseManagedAuth|DecodeManagedAuth|ClientRunsDashboardHandoff)' -count=1
• focused race tests for CLI command logic
• go vet ./cmd ./internal/browserimport
• dashboard handoff regression proves the CLI returns at finishing_managed_auth
• git diff --check browser-import/04-profile-data..browser-import/05-finished-experience