Every other Hermes gateway channel onboards through a single setup
surface (paste a token / run the wizard) with no per-platform login
command. Photon's device-code flow is unavoidable because Photon mints
credentials via API rather than a copy-paste dashboard field, but
exposing it as a top-level `hermes photon login` verb broke channel
parity.
- Remove the `login` subcommand; setup already runs the device flow as
its first step. `--no-browser` moves onto `setup`.
- Rename `_cmd_login` -> `_run_device_login` (internal helper).
- Status / credential-summary hints now point at `hermes photon setup`.
- README updated to the one-command onboarding flow.
630318e958