feat(web): default --apple-id to the single cached web session

Summary

On every asc web subcommand that requires --apple-id, default it to the single cached web session (after any existing env var), and error with the list of cached Apple IDs when there are several.

Motivation

Telemetry, 30 days, distinct installs with missing_required: web privacy pull 629 (+239 on --apple-id), web review show 279, web auth capabilities 214, web apps declarations list 46 (all 5.x). Missing --apple-id is the top web failure class on 5.x (306 installs in one week). 36% of 5.x installs touch web and login succeeds only ~30% of the time, so avoidable post-login failures matter.

Contract

• Resolution: explicit flag -> existing env var (if one exists) -> exactly one cached session (stderr: Using cached web session for user@example.com; pass --apple-id to override) -> zero sessions: usage error pointing to asc web auth login -> two or more: usage error listing them.
• web auth login itself unchanged; ephemeral/--session-from-env paths unaffected.

Acceptance criteria

• resolver unit tests with a temp session store (0/1/2 sessions; env precedence)
• cmdtest on two commands asserting stderr and exit codes, isolated from real sessions
• commands/web*.mdx + docs/COMMANDS.md updated

Partial work: worktree ~/Developer/CLIs/asc-default-apple-id (branch claude/default-apple-id-20260913).