refactor: extract shared auth and error-handling helpers

[designcode]

Summary

• Extract ~250 lines of duplicated auth/error boilerplate across 35+ command files into 4 shared helpers: failWithError, getOAuthIAMConfig, getStorageConfigWithOrg, and requireOAuthLogin
• Move getIAMConfig from access-keys/config.ts to auth/iam.ts and delete the old file
• Configure semantic-release to trigger patch releases on refactor: commits

Test plan

• npm run lint passes
• npm run build passes (tsc + tsup)
• npm run test passes (476/476)
• Binary build succeeds (npm run build:binary:current)
• Smoke tested all major commands via both binary and cli.js (whoami, credentials test, buckets list/get, access-keys list, forks list, stat, organizations list)
• Verified error paths render clean messages (no stack traces)
• Verified OAuth guards block credential users with correct messaging
• Tested login oauth, login credentials, and logout flows

🤖 Generated with Claude Code

---

Note

Medium Risk
Moderate risk because it changes authentication configuration plumbing and migrates the on-disk CLI config format (v1→v2), plus bumps core tooling dependencies; mistakes could break login/organization selection or command behavior.

Overview
Auth/config refactor: Adds shared IAM/auth helpers in src/auth/iam.ts (OAuth-only and dual-mode IAM config, Fly-org guard) and moves Auth0 config/constants into src/auth/client.ts, deleting the old src/auth/config.ts and src/auth/types.ts.

Storage format change: Reworks src/auth/storage.ts to a versioned config.json schema (v2) with a v1→v2 migration that preserves saved credentials, and makes selected-organization storage method-aware (OAuth vs credentials).

Command + CLI plumbing updates: Updates multiple commands (e.g., access-keys) to use the shared IAM config/error helpers and adds support for injecting definitions.global_arguments into per-command help/registration in cli-core.ts.

Tooling: Enables import sorting/type-import enforcement in ESLint, expands npm test to include test/auth, configures semantic-release to publish patch releases for refactor commits, and bumps various dependencies/devDependencies (including vite, vitest, typescript-eslint, and jose).

^{Written by Cursor Bugbot for commit c6cc371. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

[github-actions]

🎉 This PR is included in version 2.14.0-beta.3 🎉

The release is available on:

• GitHub release
• npm package (@beta dist-tag)

Your semantic-release bot 📦🚀