fix(auth): prevent default profile from using stale glm env vars

Issue #37: When running `ccs` (default profile), users were unknowingly
using GLM API instead of their Claude subscription because:

1. config.json had `default: '~/.claude/settings.json'` entry
2. ProfileDetector treated this as settings-based profile
3. CCS passed `--settings ~/.claude/settings.json` flag to Claude
4. Any stale ANTHROPIC_* env vars in that file got applied

Fix (3-pronged approach):
- Remove `default` entry from new config.json template
- Add migration to remove existing `default: ~/.claude/settings.json`
- Add ProfileDetector safety net: if default points to ~/.claude/settings.json,
  treat as pass-through to Claude's native auth (no --settings flag)

Now `ccs` (no profile) correctly uses Claude's native OAuth authentication
without loading potentially polluted env vars from previous sessions.

Closes #37

src/auth/profile-detector.ts

@@ -178,10 +178,21 @@ class ProfileDetector {
     const config = this.readConfig();
 
     if (config.profiles && config.profiles['default']) {
+      const settingsPath = config.profiles['default'];
+      // Safety net: If default points to ~/.claude/settings.json, treat as pass-through
+      // to avoid loading stale env vars from previous profile sessions (issue #37).
+      // The ~/.claude/settings.json is Claude's native config - let Claude handle it.
+      if (settingsPath.includes('.claude') && settingsPath.endsWith('settings.json')) {
+        return {
+          type: 'default',
+          name: 'default',
+          message: 'Using native Claude auth (no custom env vars)',
+        };
+      }
       return {
         type: 'settings',
         name: 'default',
-        settingsPath: config.profiles['default'],
+        settingsPath,
       };
     }