Add PointsPath integration: award prices joined to Matrix cash itineraries

[ak2k]

Summary

Adds a new --pp flag on flight fare that fetches PointsPath award prices for the same route and joins them onto the Matrix cash itineraries client-side, plus a small flight auth pp subgroup for token management.

$ flight fare JFK LHR --dep 2026-06-09 --pp --pp-airlines United,Delta,American
... (existing Matrix tables) ...
                   Cash + award (matched on flight # × date)
┃ flight ┃     price ┃        Economy ┃        Business ┃ ¢/mi (Y) ┃ funded by ┃
│ AA106  │ USD675.00 │ 30.0k American │ 272.0k American │     2.2¢ │ Citi      │
│        │           │           + $6 │            + $6 │          │           │
│ BA178  │ USD778.00 │ 30.0k American │               — │     1.6¢ │ Citi      │
│        │           │         + $308 │                 │          │           │

The AA106 vs BA178 contrast is the value-add: same airline-of-record award, but the BA-operated leg pulls $308 in fuel surcharges, dropping value from 2.2¢ to 1.6¢/mi.

Architecture

New src/flight_cli/pp/ package:

File	Role
models.py	Pydantic v2 shapes for airline-search + pricing-info (with null→[] coercion)
auth.py	Token store at ~/.config/flight-cli/pp.json, Supabase JWT refresh, JWT decode helpers
client.py	Async httpx client; semaphore-bounded fan-out (default 5); 401→refresh→retry; 24h on-disk cache for pricing-info
match.py	Outer-join cash itineraries to award flights by (flight_number, departure_date)
cli.py	auth pp Typer subapp (login/whoami/logout) + run_pp_for_search augmenter + Rich render

Edits to existing src/flight_cli/cli.py are minimal: register the auth subapp, add 4 flags to fare, and call the augmenter when --pp is set. Existing commands are untouched.

API surface (reverse-engineered from extension traffic)

• POST /api/airline-search — one POST per airline; returns outboundFlights[] with perCabinMilesPricing per flight
• GET /api/pricing-info — airline → transfer-partner banks + active bonus ratios + expiry
• Auth: Supabase JWT Authorization: Bearer ...; refresh via https://hxjqzkcirzhjvtubefie.supabase.co/auth/v1/token
• Public anon key bundled (extracted from extension chunk; expires 2034); PP_SUPABASE_ANON_KEY env var overrides

Auth

flight auth pp login --tokens-file <path-to-json>   # only login mode today
flight auth pp whoami
flight auth pp logout

Browser-based login is deferred — needs Playwright + the CDP cookie-sniff flow we used to bootstrap. For now, capture tokens from a logged-in Chrome session and pass them as JSON. --help documents this.

Deferred (intentionally not in this PR)

• Browser-based auth pp login (Playwright integration)
• calendar --pp (fan-out is N days × M airlines; deserves its own design pass)
• Multi-leg / round-trip PP queries (today uses leg 0 only)
• Tests
• README updates (waiting until shape settles)
• Dynamic airline catalog (today defaults to 13 airlines we observed firing for international US-EU search; PointsPath's enabled set per Pro tier likely differs)

Test plan

• flight auth pp login --tokens-file /tmp/pp_tokens.json ✓
• flight auth pp whoami decodes JWT, prints email + sub + expiry ✓
• flight auth pp logout removes the store file ✓
• flight fare JFK LHR --dep 2026-06-09 --pp --pp-airlines United,Delta,American → joined table with correct ¢/mi (verified 2.2¢ for AA award, 1.6¢ for AA-via-BA codeshare with surcharges) ✓
• pricing-info cache populated at ~/.cache/flight-cli/pp_pricing.json, second invocation hits cache ✓
• All existing commands' help output unchanged when --pp is not used
• Token refresh path (didn't exercise; needs an expired token to verify Supabase 200 path)
• 401 → refresh → retry path (didn't exercise)
• Round-trip with --return — currently uses leg 0 dep_date only; return leg ignored