The CLI client (callGateway) now reads password from:
1. opts.password (explicit parameter)
2. CLAWDIS_GATEWAY_PASSWORD env var (NEW)
3. remote.password from config
This allows CLI commands like doctor/health to authenticate
without needing a --password flag when the env var is set.
Fixes auth issues for users with password-protected gateways.