Fall back to `gh auth token` when GITHUB_TOKEN is not set

[shouze]

Context

GITHUB_TOKEN must currently be set manually in the environment before running github-code-search. Many users already have the GitHub CLI (gh) installed and authenticated via gh auth login, which duplicates the token setup step unnecessarily.

Solution

• When GITHUB_TOKEN is not set, detect whether the gh CLI is installed and, if so, retrieve a token via gh auth token.
• GITHUB_TOKEN (the env var) still takes precedence whenever it's set — zero added subprocess calls on that path.
• If gh is not installed, or gh auth token fails (not logged in, no scopes, etc.), fall back to today's existing error message unchanged.
• Isolate the gh subprocess detection/invocation in a dedicated module (e.g. src/gh-cli.ts), with the resolution decision implemented as a pure, dependency-injected function so it can be unit tested without actually spawning a process — per the "pure functions first" architecture principle in AGENTS.md. The actual Bun.which / subprocess spawn call is the sole non-tested I/O call site in that module (same convention as render/terminal.ts for Bun APIs).
• Apply the same fallback to both the search commands (default + query) and the upgrade subcommand, which already uses GITHUB_TOKEN opportunistically.

Acceptance Criteria

• When GITHUB_TOKEN is set, it is always used as-is; gh is never invoked.
• When GITHUB_TOKEN is unset, gh is installed and authenticated, the token returned by gh auth token is used transparently.
• When GITHUB_TOKEN is unset and gh is not installed (or gh auth token fails/returns empty), the existing "GITHUB_TOKEN environment variable is not set" error is shown, unchanged.
• Behavior is identical for the upgrade subcommand's optional token usage.
• Documented in docs/reference/environment.md, docs/getting-started/index.md, and README.md.

Definition of Done

• Unit tests for the pure resolution logic (dependency-injected gh detection/execution — no real subprocess spawned in tests).
• bun test, bun run lint, bun run format:check, bun run knip, bun run build.ts all green.
• Docs and the VitePress site reflect the new behavior end to end.