[patrick91]

Summary

• Handle OAuth device-flow access_denied explicitly instead of reporting a generic HTTP 400/server error.
• Show a clear authorization-declined message and guidance to start a new login and approve the request.
• Return the standard permission_denied error envelope for JSON output, without writing an auth config or continuing to poll after denial.
• Preserve generic HTTP error handling for unknown OAuth errors.

Fixes #66

Tests

• uv run pytest -q — 810 passed.
• uv run bash scripts/lint.sh — mypy, ty, Ruff lint and formatting passed.
• Clean coverage run for login/deploy tests — 108 passed; 100% coverage for src/fastapi_cloud_cli/commands/_flow.py and tests/test_cli_login.py.
• Human-output snapshots cover all login aliases and auth wait; JSON tests cover immediate denial and denial after authorization_pending.