C0: docs — default argocd login to --sso; drop extraneous --grpc-web

Now that argocd's Authentik OAuth2 client is public, `argocd login --sso`
works for day-to-day use. Promote it to the default in AGENTS.md,
argocd-cli reference, and troubleshooting; keep the admin/password flow
documented as a break-glass fallback for when Authentik is unavailable.

Also drops --grpc-web from every interactive login command — confirmed
extraneous (login succeeds without it). Left in CI workflows and
`argocd cluster add` untouched; those are different contexts that I
didn't re-test.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/reference/tools/argocd-cli.md

@@ -24,6 +24,14 @@ argocd app sync apps           # Sync the app-of-apps (picks up new Application
 
 ## Login
 
+Default (Authentik SSO, PKCE, opens browser):
+
+```bash
+argocd login argocd.ops.eblu.me --sso
+```
+
+Break-glass admin login (only if Authentik is down):
+
 ```bash
 argocd login argocd.ops.eblu.me \
   --username admin \