feat(auth): multi-org OAuth session support via --org flag

[platinummonkey]

Summary

Adds --org <name> as a global flag enabling multiple named OAuth sessions for Datadog parent/child sub-organizations. Users can now authenticate to child orgs without falling back to API/App key auth.

Closes #134

Changes

• --org global flag — works across all 283 commands; also readable via DD_ORG env var and config.yaml
• pup auth list — new subcommand listing all stored sessions as JSON/table/YAML via the formatter
• Single keychain entry per site — all org tokens are stored as a JSON map under one keychain item (tokens_<site>), so the entry count stays at one per site regardless of how many orgs are added. Avoids per-item authorization dialogs after binary upgrades.
• Transparent migration — existing bare TokenSet files/entries are promoted to the new map format on first read; no user action required
• Session registry — ~/.config/pup/sessions.json tracks org labels (no secrets) for pup auth list
• pup auth logout --org <name> — removes only the named org's tokens; client credentials (DCR) are preserved since they are site-scoped and shared across orgs

Storage key design

Scenario	Keychain / file key	Value
Default session	tokens_datadoghq_com	{"__default__": {...}}
Named org	tokens_datadoghq_com	{"__default__": {...}, "prod-child": {...}}
Client creds (unchanged)	client_datadoghq_com	{...}

Usage

# Login to child orgs
pup auth login --org prod-child
pup auth login --org staging-child

# List all stored sessions
pup auth list
pup auth list --output=table

# Use a specific org for any command
pup monitors list --org prod-child
DD_ORG=prod-child pup metrics query --query "avg:system.cpu.user{*}"

# Status / logout for a specific org
pup auth status --org prod-child
pup auth logout --org staging-child   # removes only staging-child
pup auth logout                       # removes only default session

Testing

• 21 new tests covering org_map_key, parse_token_map (including legacy migration), FileStorage map behaviour (multiple orgs, single file, delete semantics), and the session registry (save, list, dedup, remove)
• PUP_CONFIG_DIR env var now respected on native builds (matches existing WASI behaviour) to enable isolated test directories
• All 328 tests passing; cargo clippy -- -D warnings and cargo fmt --check clean

Commits

• feat(auth): add --org flag for multi-org OAuth session support
• refactor(auth): consolidate org tokens into one keychain entry per site
• test(auth): add tests for multi-org storage logic
• fix(auth): route pup auth list through formatter for clean output

---

🤖 Generated with Claude Code