auth: wire secure-storage cache into login/token/logout

[simonfaltum]

Why

Second and final PR of CLI GA MS1 (secure token storage). Plugs the
dormant building blocks from PR 1 into the user-facing auth commands.
Users opt into OS-native secure storage by setting
DATABRICKS_AUTH_STORAGE=secure (per-shell) or
[__settings__].auth_storage = secure in .databrickscfg
(per-machine). Everyone else stays on the legacy file-backed cache.
The default does not change.

Storage backend is a per-machine setting, not a per-invocation choice.
This PR deliberately ships no --secure-storage flag so that login,
token, and logout can never drift apart on the same machine.

See documents/fy2027-q2/cli-ga/2026-04-17-cli-ga-secure-storage-pr-plan.md
for the two-PR split and
documents/fy2027-q2/cli-ga/2026-04-13-cli-ga-rollout-contract.md
for the full rollout contract.

Stacks on #5008 (PR 1, Foundation). Once that merges, retarget to main.

Changes

Before: auth login, auth token, and auth logout always went
through the SDK's default file-backed TokenCache. The CLI had no
way to honor the storage-mode resolver added in PR 1.

Now:

• New helper cmd/auth/cache.go:newAuthCache(ctx, override) resolves
  the mode via storage.ResolveStorageMode and returns the
  corresponding cache.TokenCache. Split into a public form and an
  injectable core (newAuthCacheWith) so unit tests exercise the
  secure path with a fake cache. Production always passes override = ""
  and relies on env -> config -> default.
• auth login, auth token (via loadToken + runInlineLogin), and
  auth logout all call newAuthCache(ctx, "") and plumb the resolved
  cache into u2m.WithTokenCache(...) at every NewPersistentAuth
  call site.
• Acceptance tests under acceptance/cmd/auth/storage-modes/ cover
  the two CLI-visible behaviors that don't require an OS keyring:
  invalid env var surfaces a clear error, and explicit legacy mode
  behaves identically to the default path.

Out of scope (documented in the rollout contract):

• plaintext storage implementation (MS3). The resolver already
  accepts plaintext; a later milestone will route it to a non-dual
  write file backend.
• Write path for [__settings__].auth_storage (MS4 or fast-follow).
  Users hand-edit the config for MS1.
• Automatic migration of existing token-cache.json entries. Contract
  says never: users re-login after upgrading to GA.
• Flipping the default to secure (MS4).

Test plan

• Unit tests for newAuthCache covering default legacy, explicit
  override, env-var selection, plaintext fallback, invalid override,
  invalid env, and file-factory error propagation. Secure path uses
  a fake cache.TokenCache so CI never touches the OS keyring.
• Acceptance tests under acceptance/cmd/auth/storage-modes/:
  invalid-env (bogus DATABRICKS_AUTH_STORAGE surfaces a clear
  error via auth token) and legacy-env-default (explicit legacy
  mode clears the file cache via auth logout, matching default
  behavior).
• make checks, make test, make lint pass.
• Existing cmd/auth/login, cmd/auth/token, cmd/auth/logout
  acceptance test suites still pass (regression).

[github-actions]

Approval status: pending

/cmd/auth/ - needs approval

6 files changed
Suggested: @mihaimitrea-db
Also eligible: @tanmay-db, @tejaskochar-db, @hectorcast-db, @renaudhartert-db, @parthban-db, @Divyansh-db, @chrisst, @rauchy

General files (require maintainer)

9 files changed
Based on git history:

• @pietern -- recent work in cmd/auth/, ./

_{Any maintainer (@andrewnester, @anton-107, @denik, @pietern, @shreyas-goenka, @renaudhartert-db) can approve all areas.
See OWNERS for ownership rules.}