Reject empty API-key login values before saving credentials

[sdairs]

Noninteractive API-key login accepts empty key/secret strings, saves them and then reports an active read/write credential source.

Reproduced with installed CLI 0.5.0, main df81e46cfec0bb58ea981d17cc6fd2de24442e7d, in an isolated disposable project:

clickhousectl cloud auth login --api-key '' --api-secret '' --json
clickhousectl cloud auth status --json

Login exits 0 and prints Credentials saved .... Status then reports the API key as Active, scope read/write, active yes. The saved test credentials were cleared afterward. No claim is made that the empty pair authenticates to the server.

The noninteractive branch checks presence (Some) and then writes the strings. The interactive path already checks emptiness.

Expected behavior:

• Reject an empty key, empty secret, or both before creating or overwriting the credential file, with an actionable local usage error.
• Preserve an existing valid saved pair when an attempted login is invalid.
• Cover both-empty and one-empty cases, plus a valid nonempty pair. No live API call is needed for this validation.
• Keep invalid saved empty credentials from being presented as a usable active source if status encounters an older file.

Closed #853 covered missing companion flags, not explicitly present empty values. No existing open issue was found for this case. No release milestone or blocker designation is requested.