feat(cli): add kubeuser init command

[MuhanedYahya]

Why

Part of the self-service kubeconfig bootstrap initiative (tracking issue TBD, linked once created). This is the user-facing half of the bootstrap flow.

Scope

• New CLI entrypoint (module/binary layout TBD — see the packaging sub-issue for distribution).
• kubeuser init <bootstrap-url>: calls the gateway's /bootstrap endpoint, receives the kubeconfig, merges it into $KUBECONFIG or ~/.kube/config as a new named context — must not clobber existing unrelated contexts, back up the file before writing.
• Validates the gateway's TLS certificate against a proper CA (no blind trust-on-first-use).
• Clear error messages for: token already used, token expired, network/TLS failures.

Acceptance criteria

• Fresh ~/.kube/config (or none) → init creates it correctly
• Existing ~/.kube/config with unrelated contexts → init adds a new context, existing ones untouched
• Re-running init with an already-consumed token fails with a clear message, doesn't corrupt the local file
• Basic CLI tests (merge logic in particular) covering the no-clobber guarantee

Depends on

#104 (gateway /bootstrap endpoint)

[MuhanedYahya]

Part of #111