fix: warn on malformed config.json instead of failing silently (#8)

[itxhadi27-cmd]

Closes #8

loadConfig() now prints a yellow warning to stderr (matching the CLI's
existing chalk.yellow style) naming the config file path and the parse
error before falling back to defaults, instead of failing silently.

Verified manually:

• Malformed config.json → warning printed, app still starts with defaults
• Valid config.json → no warning, no regression

Note: PR #11 is already open referencing this issue — worth checking
for overlap before merge.

[itxhadi27-cmd]

Tested manually on Windows:

1. Malformed config.json (trailing comma) → warning printed with file path and exact parse error, app still starts normally with defaults.
2. Valid config.json → no warning, no extra output, no regression.

Screenshot attached below.

[github-actions]

🤖 KlaatAI Review Bot (powered by Klaatu, advisory only — a maintainer makes the real call)

Issue match
The diff fully addresses issue #8. It adds the requested chalk.yellow warning to stderr via console.warn, includes the file path and parse error message, and correctly falls back to defaults without blocking startup.

Test coverage
No tests were added. A unit test for loadConfig() is missing. It should mock readFileSync to return invalid JSON and assert that console.warn is called with the expected formatted string, while verifying the function still returns DEFAULT_CONFIG.

Correctness concerns
In src/auth/credentials.ts, the catch block captures all errors from both readFileSync and JSON.parse. If readFileSync fails due to permissions (EACCES) or the path being a directory, the warning will still say "Failed to parse", which is slightly misleading. Consider separating the read and parse steps or checking err.code for precise messaging. Additionally, the PR description notes potential overlap with PR #11.

Verdict
Needs human judgment call on whether to narrow the catch block for precise error messaging, and a manual check for overlap with PR #11 before merging.

_{This is an automated review to help triage faster, not a gate. Nothing here blocks merging.}