docs: clarify oauth2 app selection

[tcaldwell-x]

Summary

Updates documentation to match the new OAuth2 warning behavior for registered apps introduced in this PR: #74

• Recommends xurl auth oauth2 --app my-app after registering app credentials
• Explains that omitting --app saves the token to the current default app
• Updates the explicit-username OAuth2 example to include --app
• Updates the bundled xurl skill guidance
• Records the docs change in the changelog

Test Plan

• Ran go test ./...
• Ran git diff --check

[tcaldwell-x]

.