DO NOT MERGE: Require an organization key and store short-lived tokens

[ericmj]

Follow-up to the deprecations in #1179 — this is the breaking change that removes the deprecated paths. It must ship in a release after the one that carries the deprecation warnings, not together with them. Draft until then.

What changes

• mix hex.organization auth ORGANIZATION now requires --key. Without it, the task raises and points to mix hex.user auth (development) or mix hex.organization key … generate (CI).
• mix hex.organization auth ORGANIZATION --key KEY now exchanges the key for a short-lived token immediately and stores only the token, never the key. The exchange also verifies the key grants access to the organization.
• Organization repositories no longer authenticate with a stored API key. They use the cached short-lived token (from auth --key) or, failing that, the user's mix hex.user auth authentication. A stored auth_key left in hex.config by an older client is ignored.
• HEX_REPOS_KEY no longer grants access to organization repositories — authenticate per organization with auth --key instead.
• When neither a valid cached token nor user authentication is available for an organization repository, the client prints how to authenticate instead of silently failing.

Scope / compatibility

• The base hexpm repository is unchanged, including trusted mirrors authenticated with HEX_REPOS_KEY. Full removal of HEX_REPOS_KEY is intentionally out of scope here because it is also used for mirror authentication.
• The client_credentials exchange itself is unchanged, so CI keeps working: a job runs mix hex.organization auth ORGANIZATION --key $KEY and fetches with the resulting token. Since that exchange issues no refresh token, the token must be re-obtained after it expires (~30 min) — fine for a typical CI job, and the intended friction for a human pasting a key on a workstation.

Follow-up (separate, later)

The hexpm server should eventually reject the exchange of a user-owned key for repository scopes (returning invalid_scope), so the constraint reaches clients that are pinned to old Hex versions. That is deliberately deferred — it is a server-side breaking change to be timed against customer comms, and it is not part of this PR.