Auth commands added; null fields stripped

Minor Changes

• fbd856f: Add releases auth commands (login, logout, status, token) to store a verified API token in ~/.releases/credentials (0600). whoami now aliases auth status. Tokens are verified against GET /v1/tokens/me before saving; the env var RELEASED_API_KEY still takes precedence.

Patch Changes

• 69a38dc: Strip null/undefined fields from the POST /v1/sources request body in createSource(). The API's Zod schema treats z.string().optional() as "string or absent" — an explicit "productId": null in the JSON body trips the validator and 400s. Sending --org <slug> without --product previously triggered this. The fix filters null/undefined values before serialization so optional fields drop out cleanly.