feat(cli): UX & consistency polish (PR D)

[Harsh-2002]

PR D — UX & consistency polish (Tier 2/3)

Last of four back-to-back CLI gap-closure PRs. CLI-only.

Changes

• Auth-aware errors — 401/403 now say "not authenticated — run orva login, or pass --endpoint/--api-key (or set ORVA_ENDPOINT/ORVA_API_KEY)" / "not authorized…" instead of a bare API error (401) (the AI assistant: in-product agentic chat (merge-ready) #1 first-run stumble). helpers.go checkResponse.
• Destructive-op guards — dns set (replaces the whole DNS config; omitted flags clear their section) and system vacuum (write-blocking lock) now confirm() → refuse on a non-TTY without --yes, matching every other destructive command.
• Aliases (additive) — fn/fns, secret, route, key for the noun groups, and ls / rm,del on every list / delete leaf (recursive, de-duped, primary names unchanged).
• deploy --watch → --follow/-f to match logs/activity/deployments-logs; --watch kept as a hidden deprecated alias.
• JSON output holes — webhooks inbound test honors -o json (status/headers/body envelope, like fixtures test); fixtures/cron/webhooks/channels delete emit {"deleted":true,...} in JSON mode.
• stdout discipline — firewall resolve empty-result notes and the fixtures get body label now go to stderr, keeping stdout pipe-clean.
• Help — every webhooks and channels leaf gains a Long + Example (were Short-only).
• Docs — cli/CLAUDE.md refreshed: clientFactories → RegisterClient; layout lists backup.go/executions.go + the kv incr/cas and deploy --follow surfaces.

Deferred as lower-value follow-ups (noted in the commit): list-timestamp formatting unification and positional-placeholder standardization.

Tests

go vet ./... + go test ./... green; command-tree parity (slim vs server) green; deploy --follow added to required-flags test.

Live-verified on the dev instance (:3000)

fn ls alias → "Showing 1 of 5"; bad key → friendly 401; dns set / system vacuum refuse on non-TTY without --yes; webhooks delete -o json → {"deleted":true,"id":…}; secret/route/key/functions rm aliases resolve; webhooks list --help shows examples; deploy -f/--follow present.