docs+fix: document auth subcommands; enforce --no-external/--external

docs/cli.md called itself the 'complete non-interactive surface' but
never listed vulp auth add/remove/switch/test (only import) — real,
script-usable subcommands with zero documentation. Also documented
the missing --allow-secrets flag on the sync synopsis line. Separately,
'list --no-external --external' together silently returned an
always-empty result (two independent retain passes) instead of an
error; now rejected as a usage error (exit 2), matching what the
synopsis's '|' already implied.

src/cli_cmds/workspace.rs

@@ -12,6 +12,9 @@ pub fn list(
     lang: Option<String>, project: Option<String>, alerts: bool, stale_deploy: bool,
     no_external: bool, external: bool,
 ) -> Result<()> {
+    if no_external && external {
+        die(2, "--no-external and --external are mutually exclusive");
+    }
     let mut repos = scan_repos(cfg);
 
     if dirty  { repos.retain(|r| r.is_dirty); }