fix: avoid interactive SSO login during TUI startup

[nathanhuh]

Summary

Launching the TUI currently can trigger an interactive AWS SSO login before the user chooses a context or opens an AWS-backed feature. Startup should remain passive: load contexts and render the picker without forcing browser/device auth.

Problem

Model.Init loads caller identity at startup. For SSO contexts with an expired or missing AWS CLI SSO token, loadStartupCallerIdentity starts aws sso login via tea.ExecProcess. That makes unic startup perform interactive authentication even though caller identity is only display metadata.

Desired Behavior

• TUI startup loads contexts without running interactive SSO login.
• Caller identity may be loaded only when credentials are already available without prompting.
• Interactive SSO login remains tied to explicit user intent, such as selecting an SSO context or opening AWS-backed workflows.
• Existing context switching behavior still refreshes SSO when needed.

Acceptance Criteria

• unic startup does not run aws sso login for expired or missing SSO sessions.
• Startup still attempts non-interactive caller identity loading only when safe.
• Context switching to an SSO context still prompts for SSO login when needed.
• Tests cover expired/missing SSO token startup behavior and existing context switch behavior.
• README/docs are updated if user-visible startup auth behavior is documented.

Notes

Raised from review of startup auth behavior on 2026-05-27.

[nathanhuh]

@Unic-bot: assign me

[github-actions]

@nathanhuh has been assigned to this issue.

[nathanhuh]

Implemented locally on branch fix/221-startup-sso-passive in worktree /private/tmp/unic-221-startup-sso.

Summary:

• Startup now uses a passive caller-identity loader.
• SSO startup identity loading checks the SSO cache and skips identity lookup when login would be required.
• Context switching still prompts for SSO login when needed.
• README documents passive SSO startup behavior.

Validation:

• go test ./internal/app
• make test
• make build