Add support for passing an access token directly via --access-token flag
or GOG_ACCESS_TOKEN environment variable. This enables headless/CI usage
without browser-based OAuth or keyring access.

To test this feature:

```bash
git clone https://github.com/mmkal/gogcli
cd gogcli
git checkout mmkal/26/01/28/--access-token
make build

./bin/gog gmail labels list --access-token "$(gcloud auth print-access-token)"

export GOG_ACCESS_TOKEN="ya29.a0AfH6SM..."
./bin/gog gmail labels list
```

If you have a refresh token managed externally, exchange it:

```bash
curl -X POST https://oauth2.googleapis.com/token \
  -d "client_id=YOUR_CLIENT_ID" \
  -d "client_secret=YOUR_CLIENT_SECRET" \
  -d "refresh_token=YOUR_REFRESH_TOKEN" \
  -d "grant_type=refresh_token"
```

- internal/authclient/authclient.go: Added WithAccessToken() and
  AccessTokenFromContext() context helpers (similar to existing
  WithClient/ClientOverrideFromContext pattern)

- internal/cmd/root.go: Added AccessToken field to RootFlags with
  env:"GOG_ACCESS_TOKEN" tag, wired context injection in Execute(),
  and added stderr warning about token expiry

- internal/googleapi/client.go: Modified optionsForAccountScopes() to
  check for access token in context first and use oauth2.StaticTokenSource
  when present (bypassing refresh token flow entirely)

- internal/cmd/account.go: Modified requireAccount() to make --account
  optional when --access-token is provided (returns placeholder account)

- Access tokens expire in ~1 hour; long-running operations may fail
- No automatic refresh—users must provide fresh tokens
- No scope validation—API errors if token lacks required scopes
- A warning is printed to stderr when using this mode

Added unit tests for:
- authclient context helpers (authclient_test.go)
- optionsForAccountScopes with access token bypass (client_more_test.go)