auth: session list --stream-url default pins localhost:4437 which no longer exists post-#1211

[rickylabs]

Found during the #1240 docs port sweep. netscript plugin auth session list defaults --stream-url to http://localhost:4437/auth/sessions (packages/cli/src/public/features/plugins/auth/auth-plugin-command.ts:87). PR #1211 replaced fixed scaffold ports with a seeded per-project allocator — the streams runtime no longer binds 4437 in any new scaffold, so the default silently points at nothing (or at a foreign process squatting the port, the exact failure class #1202 documented).

The command needs to resolve the actual assigned streams endpoint (AppHost/appsettings discovery, same as the #1206 aspire-cli adapter does for services) or at minimum fail with a message that says the default is a legacy pin and how to find the real URL.

Related legacy pins in the same class, for one sweep: plugins/streams/scaffold.plugin.json servicePort/backgroundPort 4437 (installer ignores them — allocation comes from portRangeKey; keeping dead values in the manifest invites exactly the doc drift #1240 is cleaning), and copy-official-plugin-test-support.ts:108.

Acceptance

• netscript plugin auth session list has no silent localhost:4437 default and requires an explicit streams session URL.
• Omitting --stream-url fails before the session adapter and gives actionable aspire describe streams --format Json endpoint-discovery guidance.
• Every other filed 4437 occurrence is removed or explicitly classified: the streams manifest and official-copy values remain required compatibility metadata and are unchanged.

Verified by PR #1643 Tier-A PASS comment 5286347517 and separate opposite-family IMPL-EVAL PASS at evaluator commit a949a6cd1777b0d05b1a3b45143de15951aa6dc2.

[rickylabs]

Milestone rollover (owner-directed, 2026-08-06): moved from the former mixed milestone 24, now renamed 0.0.7 for the Frontend Contribution Layer, into the newly created 0.0.6. This open item is not #922 or an epic:frontend-contrib child, so it belongs in the immediate post-0.0.5 follow-up release. Closed historical assignments were not changed.