Friendlier handling of incomplete local AWS credentials

[blsmth]

Closes #155.

Problem

With a partially-configured default profile (or stray AWS_* env vars), every command except apppack auth failed with the raw SDK error:

error fetching config from profile, default, Error using profile:
 2, partial credentials found for profile default

auth worked because it's a pure OAuth flow; everything else calls LoadDefaultConfig, which eagerly loads and validates the local ~/.aws files before doing any real work.

Key finding

I reproduced this and confirmed the SDK trips on a partial [default] profile even when static credentials are supplied via WithCredentialsProvider — so just wrapping the error (the original proposal) wouldn't make OAuth-authenticated commands work; it would only reword the failure. The maintainer's suggestion on the issue (bypass loading default config for the OAuth flow) is the real fix.

Fix — two treatments matching the two kinds of call site

1. OAuth paths (AppAWSSession, AdminAWSSession, GetCredentials) — these inject OAuth-derived static credentials / use web-identity federation and never need the local files. New ignoreSharedConfigFiles() load option disables shared config/credentials file loading. This eliminates the "auth works but nothing else does" failure.
2. --aws-credentials paths (app.Init, cmd/access.adminSession) — these read local config by design, so bypassing isn't an option. New auth.FriendlyAWSConfigError() detects the "partial credentials" signature and appends a hint at the real, machine-local cause (original error preserved via %w).

Verification

• Reproduced the failure against a partial [default] profile and confirmed the shared-file bypass makes the static-cred path succeed.
• auth.FriendlyAWSConfigError unit-tested (nil passthrough, partial-cred hint, errors.Is unwrap, unrelated passthrough).
• go build ./..., go test ./auth/... ./app/... ./cmd/..., and golangci-lint run ./auth/... clean (only pre-existing errcheck findings remain).