Don't accept Replicate API tokens for CLI login
If the token pasted for CLI login starts with `r8_`, reject it with an
error message before we even start.
This also clears up some of the surrounding copy, which is pretty
confusing and could easily have led to people thinking an API token was
valid here.
