feat(auth): link to /console from CLI auth success state (TASK-856) (#279)

After approving a CLI session at /auth/cli/{code}, the success state
previously dead-ended with "you can close this tab" and no link out.
Adds a primary "Go to your workspaces" CTA linking to /console — the
same destination that / redirects to and that pad-cloud's OAuth flow
lands users on post-login. Universal across self-hosted, Docker, Remote,
and Pad Cloud (which proxies /auth/cli/ to the upstream pad backend
via nginx, no pad-cloud change needed).

The existing "you can close this tab" message stays — some users
(CI runs, headless approvals, teammate's laptop) genuinely just want
to close the tab.

Source: IDEA-848.
Parent: PLAN-833.

web/src/routes/auth/cli/[code]/+page.svelte

@@ -171,6 +171,7 @@
 		{:else if status === 'success'}
 			<p class="subtitle">Authorized</p>
 			<p class="success-message">CLI session authorized. You can close this tab.</p>
+			<a href="/console" class="primary-link">Go to your workspaces</a>
 		{/if}
 	</div>
 </div>
@@ -259,6 +260,27 @@
 		cursor: not-allowed;
 	}
 
+	.primary-link {
+		display: block;
+		width: 100%;
+		padding: var(--space-3) var(--space-4);
+		margin-top: var(--space-4);
+		background: var(--accent-blue);
+		color: #fff;
+		border: none;
+		border-radius: var(--radius);
+		font-size: 0.95rem;
+		font-weight: 500;
+		font-family: var(--font-ui);
+		text-align: center;
+		text-decoration: none;
+		transition: opacity 0.15s;
+	}
+
+	.primary-link:hover {
+		opacity: 0.9;
+	}
+
 	.account-chip {
 		display: flex;
 		align-items: center;