feat: Revamp udash login - #9924

The goal of this pr is to have a credential that Updatecli can hold that does not expire, for CI and
laptops alike, with Zitadel as the identity backend.

Zitadel cannot issue one from an interactive login — access-token lifetime is a
project setting, default 12h. So the durable credential has to be one Udash
issues and validates itself. Once that is true, Updatecli only ever needs to
carry a bearer token, and its OAuth client stops earning its keep.

pkg/core/udash/ was written against Auth0 and could not have worked against Zitadel:

After this change Updatecli never contacts an identity provider.

What changed

Deleted

github.com/skratchdot/open-golang/open stayed — still used to open the tokens
page. golang.org/x/term was promoted from indirect to direct.

pkg/core/udash/login.go — rewritten

func Login(udashEndpoint, udashAPIEndpoint, token string) error

Three ways to supply the token:

updatecli udash login <url> --token udash_pat_xxx   # non-interactive
echo $TOKEN | updatecli udash login <url>           # piped, for scripts
updatecli udash login <url>                         # opens /profile/tokens, prompts with echo off

Before storing anything it calls GET {api}/whoami, so a typo'd or revoked token
fails at login, not silently three weeks later when a pipeline tries to
publish.

It also probes whether the service authenticates at all: /whoami only exists
when a mode is configured, so a 404 means the instance is open and no token is
asked for. Without that, the default auth-disabled deployment could not be
registered — this was caught by a test after the first implementation.

pkg/core/udash/whoami.go — new

callWhoami / requiresToken / whoami. An older Udash with no /whoami
endpoint is accepted rather than refused, since the rest of its API may work fine.

Bug fixes carried along

• config_spec.go — writeConfigFile used os.Create, landing the file at
  0644. World-readable, for a file holding a bearer token that now never
  expires. It is 0600.
• logout.go — when the last credential was removed the function returned
  before writeConfigFile, so logging out of your only configured service never
  persisted. The write moved above the early return.

CLI surface

No deprecation aliases as the feature is gated behind --experimental.

udash.Audience → udash.APIURLSelector. It was never an OAuth audience — it is
the selector for which stored credential to use, set by --reportAPI. The six
identical --reportAPI registrations across apply/diff/compose/pipeline moved
into addReportAPIFlag, matching the existing addXFlag helpers in cmd/flags.go.

Test

To test this pull request, you can run the following commands:

cd pkg/core/udash
go test

Additional Information

Checklist

• I have updated the documentation via pull request in website repository.
• I have tested this pull request manually with a custom Updatecli build and it works as expected.

Tradeoff

Potential improvement