feat(config): write credentials to state.toml and the OS keychain

[LorrisSaintGenez]

What

• auth login, application create and application select now persist credentials to the new model: API key in the OS keychain, api_key_uuid + alias + current application in state.toml (config.toml is no longer written by these flows)
• Keychain is written first, then state.toml, so a keychain failure never leaves state pointing at a missing key; empty alias/uuid preserve existing values, and the stored crawler key survives re-login
• auth crawler stores the crawler API key in the application's keychain entry; it now requires a new-model application (legacy-only users are told to run algolia auth login)
• The crawler user ID is no longer stored: the factory lazily fetches it from the dashboard API when env/config.toml can't provide it
• Existing keys are reused (keychain first, then legacy config.toml profiles) to avoid creating duplicate dashboard keys

Test

1. make build — produces ./algolia with the required ldflags (OAuth client ID, dashboard URL); a stable binary also avoids repeated macOS keychain prompts
2. ./algolia auth login — then cat ~/.config/algolia/state.toml: expect current_application_id, plus api_key_uuid and alias under [applications.<APP_ID>]
   • note: api_key_uuid is only set when a fresh key was generated; if the key was reused (already in the keychain or in a legacy config.toml profile), it stays empty by design — same rule as the upcoming migration (GROUT-363)
3. security find-generic-password -s algolia-cli -a "app:<APP_ID>" -w | sed 's/^go-keyring-base64://' | base64 -d (macOS) — expect the {"api_key": ...} JSON entry; go-keyring's macOS backend stores values base64-encoded with a go-keyring-base64: prefix (decoded transparently on read)
4. ./algolia application select — re-selecting the same application must NOT create a new dashboard key (key is reused); selecting another one updates current_application_id
5. ./algolia auth crawler — adds crawler_api_key to the same keychain entry; then run any crawler command to exercise the lazy user-ID fetch
6. ./algolia indices list — exercises the read path end to end; config.toml's mtime must never change (these flows no longer write it)

Stacked on #235 (feat/read-resolution); retarget to feat/profile-depr once #235 merges.

GROUT-305

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 47 complexity · -2 duplication

Metric	Results
Complexity	47
Duplication	-2

View in Codacy

_{TIP This summary will be updated as you push new changes.}