sub-account auth

[markmnl]

No description provided.

[Copilot]

Pull request overview

This PR updates fmsg-cli authentication to support both main-account user JWTs and sub-account opaque API keys (exchanged for short-lived JWTs), and wires token refresh into the HTTP client and CLI commands.

Changes:

• Replace locally-minted JWT auth with API-key exchange (POST /fmsg/token) + cached/auto-refresh JWTs, while still supporting direct user JWT login.
• Refactor API client auth to use a token provider and retry once on 401 with a forced refresh for replayable requests.
• Update CLI commands, tests, and documentation/env examples to reflect the new auth modes and flags.

Reviewed changes

Copilot reviewed 26 out of 27 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
README.md	Documents JWT vs API-key login flows, env var FMSG_API_KEY, and updated command usage/examples.
internal/config/config.go	Adds FMSG_API_KEY env lookup helper.
internal/auth/token.go	Removes local JWT mint/validate implementation.
internal/auth/store.go	Expands stored credential schema (versioned, supports api key + access token metadata).
internal/auth/manager.go	Adds auth manager for exchanging API keys, caching tokens, parsing JWT claims, and persisting refreshed creds.
internal/auth/manager_test.go	Adds unit tests for exchange, caching/refresh, env override behavior, and secret non-leakage.
internal/api/client.go	Introduces TokenProvider, trims base URL, retries replayable requests after a 401 with forced refresh.
internal/api/client_test.go	Tests 401 refresh + replay for replayable requests.
go.mod	Drops github.com/golang-jwt/jwt/v5, adds golang.org/x/term (and indirect x/sys).
go.sum	Updates checksums for dependency changes.
cmd/client.go	Centralizes creation of authenticated API client + auth manager.
cmd/login.go	Updates login to accept API key or user JWT, adds --address, and hides input on TTY.
cmd/root.go	Updates root help text to reflect new login args.
cmd/list.go	Uses authenticated client helper instead of loading static creds.
cmd/sent.go	Uses authenticated client helper instead of loading static creds.
cmd/get.go	Uses authenticated client helper instead of loading static creds.
cmd/get_data.go	Uses authenticated client helper instead of loading static creds.
cmd/get_attach.go	Uses authenticated client helper instead of loading static creds.
cmd/attach.go	Uses authenticated client helper instead of loading static creds.
cmd/rm_attach.go	Uses authenticated client helper instead of loading static creds.
cmd/del.go	Uses authenticated client helper instead of loading static creds.
cmd/add_to.go	Uses authenticated client helper instead of loading static creds.
cmd/send.go	Uses authenticated client helper and derives from via manager.User().
cmd/draft.go	Uses authenticated client helper and derives from via manager.User().
cmd/update.go	Uses authenticated client helper and derives from via manager.User().
cmd/msgid_test.go	Updates tests for new api.New(baseURL, TokenProvider) signature.
.env.example	Replaces FMSG_JWT_SECRET with optional FMSG_API_KEY example.