Add oc session ls|rm, PowerShell login docs, Windows test fix

[Chagas74]

Implements the planned \session ls|rm\ commands and two doc gaps found while adapting oc for a Windows agent setup.

Added

• \oc session ls\ lists saved sessions (name, url, title; --json\ supported,
  o saved sessions\ when empty)
• \oc session rm [name]\ forgets a session — saved page plus cookies, the same promise \oc logout\ makes (defaults to --session, refuses path-like names)
• Tests for ls/rm in \ ests/cli.test.js\ (empty store, listing, rm by name/flag incl. cookie sidecar, invalid name, usage)

Docs

• PowerShell equivalent for cookie login in README + skill (\printf\ does not exist on Windows)
• State location on Windows (%USERPROFILE%\.only-cli, \OC_HOME) in README + skill + \session ls|rm\ in llms.txt
• CHANGELOG entry under Unreleased

Fixed

• Test harness resolves the binary with \ileURLToPath\ (\URL.pathname\ breaks on Windows paths with spaces/drive letters) in cli, cli-auth, distill tests

Validation

• Full suite: 221 pass, 1 fail — the cookies \chmod 0600\ test, which fails identically on a pristine checkout on Windows (pre-existing, untouched by this PR)

[only-cli]

Thanks for this PR, @Chagas74! session ls|rm fills a real gap, and the PowerShell login docs plus the fileURLToPath harness fix are welcome too.

I reviewed it and pushed one follow-up commit (b990662) onto your branch rather than round-tripping, since the fixes were mechanical. Please glance over it and shout if anything looks off:

• session ls now lists cookie-only sessions. oc login --session work writes a jar and no page, so the listing said no saved sessions while a live credential sat on disk. Sessions holding a jar are marked [cookies] in text and get a cookies field in --json.
• session rm no longer reports success unconditionally. clearSession/clearCookieJar swallowed every unlink error, so a read-only directory or a typo like rm wrok printed forgot session with exit 0. They now ignore only ENOENT, and rm fails with no such session when nothing was removed. logout keeps its silent exit 0. Both share one forgetSession helper.
• Names ending in .cookies are rejected. Session x.cookies saved its page at x.cookies.json, the path of x's jar, so rm x deleted it and ls hid it.
• ls uses the same name check as rm and skips non-files, so a stray ..json or a directory named like a page is no longer listed as something rm cannot remove. The sidecar suffix is one exported constant shared by session.js and cookies.js.
• Docs: light copy edits, and the CHANGELOG now says only the CLI tests run on Windows, since the cookie file-mode test still fails there.

Tests added for each of the above; the full suite passes locally.