login --token-stdin: a token a program already holds, checked, then stored as a device login

`lembas login --token-stdin --server <url> [--ca file] [--json]` reads one lmb_ token from
stdin (never an argument or the environment), checks discovery's protocol and then
GET /api/v1/instance with the token, whose `scope` must include `link` (a 404 or no `scope`
is an older server), and stores the login through the same path as the device code:
the key file, the webui entry, lembas.json, an earlier login replaced with its token signed
out naming the new one. --json prints the device login's `done` / `error` line. For LLeMbas
Desktop, which gets the agent's token from the one approval.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

README.md

@@ -27,6 +27,10 @@ lembas login https://your-server       # sign in to your LLeMbas server
 cd your-project && lembas              # the TUI, on the server's models
 ```
 
+A program that already holds an agent's token for this machine (LLeMbas Desktop does, from the
+same approval as its own) hands it over on stdin, never as an argument:
+`… | lembas login --token-stdin --server https://your-server [--json]`.
+
 From 2.0 the CLI talks only to the LLeMbas server it is logged in to; the custom connections of 1.x
 (`dialect:` entries in `connections.yaml`) are gone.