feat(auth)!: make browser OAuth/PKCE the only credential source

[Priyanshu (priyanshu-plivo)]

What

config.Resolve() read PLIVO_AUTH_ID / PLIVO_AUTH_TOKEN and ranked them above the active profile. That is the one path by which a raw, long-lived auth_token enters the CLI — pasted into a shell profile, or held as a CI secret — which is exactly the material the PKCE handshake exists to avoid minting. With it present, the hardened flow was opt-in.

This removes it. Credentials now come only from a profile written by plivo login.

Resolution order: --profile → active profile.

Behaviour change

$ PLIVO_AUTH_ID=MA... PLIVO_AUTH_TOKEN=... plivo account get --dry-run
# before: [dry-run] GET https://hodor.plivo.com/v1/cli/api/v1/Account/MA.../
# after:  AUTH_MISSING  "Run `plivo login`."  (exit 2)

BREAKING: headless/CI callers that exported those vars no longer authenticate. There is no device-code flow, so such a host needs a profile logged in on it beforehand. cli-skill/SKILL.md previously instructed agents to authenticate this way; its Headless section now tells them to stop and ask a human rather than attempt it.

Notes for review

• scripts/smoke.sh depended on this. It exported placeholder creds so the ~21 --dry-run URL assertions could resolve a credential, and runs in CI on Linux/macOS/Windows. It now writes a throwaway profile into a temp HOME. USERPROFILE is set alongside HOME because Go's os.UserHomeDir() reads that one on the Windows smoke-os leg. No product code was bent to accommodate the test.
• credentialHint() loses its unreachable "env" case. The surviving profile branch also changes plivo login --profile X → --name X: --profile selects a profile, it does not name one at login, so the old hint pointed at a no-op.
• Tests: the six TestResolve_*Env* cases were the removed feature's own unit tests and are deleted. TestResolve_credEnvVarsAreIgnored replaces them as a regression guard. setFakeCreds used env vars as its only way to supply credentials, so it now writes a profile; setEmptyHome was split out for the two tests that genuinely want an empty config.
• agents-skill/SKILL.md:298 left alone on purpose — that Python snippet calls api.plivo.com directly with Basic auth and never goes through the CLI's resolution.
• No CHANGELOG entry: per RELEASING.md step 2 that section is written in the chore: cut vX.Y.Z PR.

Verification

• make fmt vet test test-tap test-release-notes — green
• make docs && git diff --exit-code docs/COMMANDS.md — clean (regenerated, committed)
• ./scripts/smoke.sh ./plivo — passes locally on Darwin/arm64
• Env vars + empty HOME → AUTH_MISSING; real profile → plivo auth whoami returns the live account