fix(cli): harden init MCP installer

[hmishra2250]

Summary

• route interactive firecrawl init MCP setup through the pinned hosted installer
• remove the unpinned add-mcp / firecrawl-mcp subprocess path and stored-key child environment
• add init regression coverage for secure delegation and sanitized failures

Contract

• unattended/keyless setup remains on https://mcp.firecrawl.dev/v2/mcp
• no OAuth endpoint change

Validation

• pnpm exec vitest run src/__tests__/commands/init.test.ts
• pnpm test (389 passed, 1 skipped)
• pnpm run type-check
• pnpm run format:check

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Hardened firecrawl init MCP setup and kept it usable without exposing keys. Interactive flow now delegates to the pinned hosted installer with a keyless fallback and redacted error messages.

• Bug Fixes
  • Interactive MCP setup now uses the hosted installMcp (pinned) with keyless when no environment-backed key is present; no more skipped install.
  • Removed the direct add-mcp/firecrawl-mcp subprocess and the child env that carried FIRECRAWL_API_KEY.
  • Added tests to enforce secure delegation, keyless installs to https://mcp.firecrawl.dev/v2/mcp, and credential redaction in errors.

^{Written for commit c28d8ed. Summary will update on new commits.}