Keep separate environment logins from breaking each other

[scotwells]

Fixes #238

What this fixes

Signing in to two Datum Cloud environments — say production and staging — with the same email address quietly broke authentication.

Both logins were stored under one credential slot, so the second sign-in overwrote the first. Everything looked fine (datumctl auth list still showed both accounts), but after datumctl auth switch the CLI would send one environment's token to the other's API and fail with:

error: You must be logged in to the server (the server has asked for the client to provide credentials)

To the user it looked like switching accounts randomly corrupted their login.

What changed

Logins are now kept separate per environment. Signing in to production and staging no longer share (and clobber) one stored credential. Switching accounts, automatic token refresh, and logout all stay scoped to the right environment.

Existing installs heal themselves. The first time an already-signed-in user runs a command that authenticates, their stored logins are upgraded in place — no manual steps. The migration is non-destructive: it never deletes a token it can't first preserve. The one account whose token was already overwritten before this fix simply needs a single fresh datumctl login (its old token was unrecoverable).

datumctl auth switch now shows the active account. The account you're currently signed in as is labelled (active) and the picker opens on it, so it's clear what you're switching from:

Which login session?
> swells@datum.net  (api.staging.env.datum.net)  (active)
  swells@datum.net  (api.datum.net)

How it was verified

• New unit tests cover the collision-recovery, idempotency, and already-migrated cases.
• Exercised end-to-end against a real two-environment config: the surviving environment kept working immediately, and the overwritten one correctly resolved to its own (empty) credential and prompted for re-login instead of silently borrowing the wrong token.
• go build ./..., go vet, go test, and go install ./... all pass.

Upgrade notes for users

• No action needed for the environment whose token is currently active — it keeps working.
• The other environment needs one re-login: datumctl login --hostname <that env's auth host>.

🤖 Generated with Claude Code