Fix cloud CLI auth and post-merge regressions

[RasulOs]

Summary

• Switch cloud CLI auth to MOBILERUN_CLOUD_API_KEY and intentionally ignore legacy MOBILERUN_API_KEY for cloud commands.
• Make mobilerun devices --cloud fail nonzero for missing auth or SDK/API errors while keeping plain mobilerun devices best-effort for local listing.
• Harden saved cloud login credentials with private directory/file permissions and atomic same-directory replacement.
• Remove stale public TUI references while keeping TUILogHandler compatibility exports.

Test Plan

• UV_CACHE_DIR=/private/tmp/uv-cache uv sync --python 3.13 --group dev --locked
• UV_CACHE_DIR=/private/tmp/uv-cache uv run ruff check .
• UV_CACHE_DIR=/private/tmp/uv-cache uv run pytest -q
• UV_CACHE_DIR=/private/tmp/uv-cache uv run python -m compileall -q mobilerun tests
• UV_CACHE_DIR=/private/tmp/uv-cache uv lock --check
• Wheel metadata check: no mobilerun/cli/tui, no textual, no public TUI marketing text
• Live cloud invalid-key probe exits 1 with MOBILERUN_CLOUD_API_KEY=fake
• Live /device/code endpoint returned valid device/user codes
• Android emulator Medium_Phone_API_36.1: ping, devices, device ui, device screenshot, device press home
• Anthropic API-key agent smoke on emulator passed
• Claude Code final diff review: no findings

[mintlify]

Docs PR opened: https://github.com/droidrun/mobilerun-docs/pull/24

Documented the cloud CLI auth flow, including login, logout, whoami, devices --cloud, and the MOBILERUN_CLOUD_API_KEY variable.