docs: auth token's example stops putting the credential in argv

The command's own example interpolated the token into curl's arguments,
where any local user can read it from ps for the life of the request —
the CLI teaching the unsafe shape. It now leads with flagsmith api,
where the credential never leaves the process, and shows a curl form
that pipes the header in via -H @- (verified: curl reads @- from stdin).

Addresses Themis review on #43 (auth.go:215).

beep boop

Author: khvn26

internal/cmd/auth.go

@@ -211,9 +211,12 @@ var authTokenCmd = &cobra.Command{
 	Short: "Print the active Admin API credential (for curl and scripts)",
 	Example: `  flagsmith auth token
 
-  # e.g. drive curl with it
-  curl -H "Authorization: Api-Key $(flagsmith auth token)" \
-    https://api.flagsmith.com/api/v1/organisations/`,
+  # to call the API, prefer flagsmith api: the credential never leaves the process
+  flagsmith api api/v1/organisations/
+
+  # with curl, pipe the header in
+  flagsmith auth token | sed 's/^/Authorization: Api-Key /' |
+    curl -H @- https://api.flagsmith.com/api/v1/organisations/`,
 	RunE: func(cmd *cobra.Command, args []string) error {
 		if _, err := applyContext(cmd); err != nil {
 			return err