feat(cli): interactive credit-gate notice UX [VOL-354]

[tkkhq]

Summary

Finishes the CLI-side of the billing/credit gate (VOL-354) by turning the placeholder low_credit_warning / not_enough_credit notices in internal/cmd/upgrade into the designed interactive UX. Server-side work (volcano-hosting) and its billing-service integration design are out of scope here and tracked separately — this change stays dormant until the API emits the header.

Design decisions:

• Never changes exit status. The credit instruction is observed after the command already ran (a response header), so the CLI cannot retroactively block it. not_enough_credit is non-zero only when the underlying command already failed for its own reasons; real enforcement stays server-side.
• Warn + actionable link, always. One concise, neutral stderr notice plus a billing URL derived from config.WebURL() (VOLCANO_WEB_URL overrides) — https://volcano.dev/billing?source=cli. No speculative API-provided-URL wire contract is introduced.
• Interactive prompt, safely gated. Offers to open the billing page only when the command is explicitly prompt-safe, CI is unset, and both stdin and stderr are terminals. On consent it opens the browser; on decline, prompt error, or open failure it prints the URL. Scripts/CI/pipes are never affected.

Changes

• internal/confirm: generic Confirm(r, w, message) prompt primitive.
• internal/api: WebBillingURL helper (mirrors WebSignupURL).
• internal/cmd/upgrade/credit.go: notice rendering, CreditPromptSafeAnnotation opt-in gate, TTY/CI checks, browser open, URL fallback.
• cmd/volcano/main.go: root.ExecuteC() to pass the executed leaf command so its prompt-safe annotation can be read; 426 short-circuit + error-first ordering unchanged.
• docs/credit-gating.md (+ README link).

Audience

• End users: clearer credit messaging with a one-tap purchase path in interactive terminals; unchanged behavior in scripts/CI.
• Contributors: credit-gate UX is fully covered by hermetic tests and stays dormant until the server opts in.

Test

• go build ./...
• go test ./... (40 packages OK)
• go tool golangci-lint run ./... (0 issues)

Notes / follow-ups (out of scope)

• Server-side creditgate.Provider + billing integration (volcano-hosting).
• Marking specific finite commands (e.g. deploy) prompt-safe once the server contract lands.