fix: reject non-object auth.json with AuthError

load_auth_file() returned json.loads() output directly. Valid JSON that
is not an object (array, string, number, null) made callers such as
stored_auth_record() and clear_auth() crash with AttributeError or
TypeError. Raise AuthError instead, consistent with the decode error
path.