feat(config): align init/config UX with atlassian-cli patterns

[rianjs]

Summary

Aligns hspt init and config commands with UX patterns established in atlassian-cli.

Changes

• Init uses huh forms: Replaced bufio prompts with styled huh form with validation
• Init pre-populates: Form fields are pre-filled from existing config values
• Config clear confirmation: Added --force flag; shows confirmation prompt when not provided
• Removed config set: Users should use init to change configuration
• Fixed token masking: Changed from first4...last4 to first4********last4

Test plan

• make build passes
• make test passes
• make lint passes
• Manual: hspt init shows styled form
• Manual: hspt config show masks token correctly
• Manual: hspt config clear prompts for confirmation

Closes #43

[rianjs]

Test Coverage Assessment

Summary

The PR adds a test file (configcmd_test.go) with good coverage for the maskToken function. However, there are some gaps in test coverage for other changes in this PR.

What's Well Tested

maskToken function - The new test covers:

• Empty token (edge case)
• Short tokens (<=8 chars boundary)
• Exactly 8 chars (boundary condition)
• 9 chars (just over boundary)
• Long tokens (typical case)

This is solid coverage with good boundary testing.

Coverage Gaps

1. config clear command changes - Not directly tested

• Added --force flag behavior
• Added confirmation prompt logic (lines 88-96)
• The confirmation parsing logic (y, yes, case-insensitive) is untested

The confirmation flow has branching logic that could benefit from unit tests, particularly the string parsing (response != "y" && response != "yes"). However, this is interactive I/O code that's harder to unit test and is reasonable to cover via manual testing.

2. init command rewrite - No unit tests

• Replaced bufio prompts with huh forms
• Pre-population logic (lines 76-82)
• Token priority logic (CLI flag > existing config)

The init command is now using huh forms which are inherently interactive and difficult to unit test without mocking the terminal. The pre-population priority logic is straightforward and the manual test plan in the PR covers the key user-facing behavior.

3. getTokenSource function - Untested

• This function existed before and remains untested
• Simple logic with clear branching

4. Removed config set command

• No tests needed for removed code

Verdict

Acceptable coverage for this PR. The key business logic change (maskToken) has thorough unit tests. The remaining untested code is:

1. Interactive UI code (huh forms, fmt.Scanln prompts) - These are standard patterns that are difficult to unit test and are appropriately covered by the manual test plan
2. Simple flag handling (--force) - Straightforward Cobra flag wiring
3. Pre-existing untested code (getTokenSource) - Out of scope for this PR

The test plan in the PR description appropriately lists manual verification for the interactive elements. A reviewer should verify those manual checks are completed before merging.

Recommendations (optional, non-blocking)

If the team wants to increase coverage in the future:

• Extract the confirmation response parsing into a testable helper function
• Consider using huh test helpers if they become available for form testing
• The getTokenSource function could use a simple unit test, though it's unrelated to this PR