Finish the local browser import experience - #233

What

• hands a completed local browser import back to the originating dashboard operation
• displays Managed Auth usage, plan maximum, and remaining new-connection capacity
• constrains only net-new connections; existing imported connections remain refreshable at capacity
• shows a four-stage elapsed-time progress bar during preparation, upload, profile apply/save, and completion
• exits the connector flow once the durable API queue starts, allowing its Terminal tab to close
• reports imported/skipped browser-data counts and preserves partial storage results
• defaults repeat local-browser imports to updating the existing Kernel profile instead of creating a suffixed duplicate
• makes creating a separate profile explicit and shows when the same account is already managed on another profile

This is the CLI finished-experience layer for KERNEL-1975.

Why

The customer must understand how many Managed Auth connections their plan permits and must see that a multi-minute server apply is progressing. Once the API owns durable post-import authentication, the local CLI should not remain open while that background queue runs. Repeat imports should refresh the existing profile and its attached Managed Auth connections instead of silently creating helium-you-2 and consuming duplicate connection slots.

How

• reads the merged max_auth_connections and auth_connections_used organization-limit fields exposed by the current API/SDK
• distinguishes unlimited, known-zero, positive, and temporarily unknown capacity
• classifies existing connections before applying capacity to net-new selections
• keeps create-time API quota enforcement authoritative for races
• advances an honest coarse progress bar only at completed client/server milestones
• treats finishing_managed_auth as a successful dashboard handoff phase
• looks up the default Kernel profile before upload and offers Update (recommended) or Create separate
• sends the immutable existing profile ID only when Update is selected
• when Create separate is selected, detects the same imported credential on other profiles and defaults to Keep existing (0 slots); Also manage on the new profile explicitly consumes a slot

The latest published Go SDK does not yet expose connections_used on /org/entitlements; using the generated /org/limits fields avoids a hand-written HTTP path while preserving the merged entitlement values.

Deployment

Stacked on #229. Merge only after kernel/kernel#3453 and the explicit profile-update API in kernel/kernel#3477 are deployed, then publish and verify the Homebrew CLI before enabling the dashboard consumer. Old APIs reject target_profile_id, so this order is required.

Verification

• focused go test -race ./cmd for repeat-profile selection, cross-profile Managed Auth choices, quota handling, and label behavior
• go test ./cmd ./internal/browserimport -count=1
• go vet ./cmd ./internal/browserimport
• dashboard handoff regression proves the CLI returns at finishing_managed_auth
• git diff --check origin/browser-import/05-finished-experience...HEAD

The full unfiltered CLI race suite still reports an unrelated pre-existing pterm spinner race in template-creation tests; every changed path passes under -race.