feat(synthetics): accept OAuth2 for synthetics tests run

[jaluna0]

Summary

synthetics tests run is the only synthetics command that rejects an OAuth2 session (pup auth login). It hard-requires DD_API_KEY + DD_APP_KEY, while every sibling command works with a bearer token. This makes it accept OAuth2 too — preferring the bearer, falling back to keys.

Why

tests_run builds its own reqwest::Client and its build_auth_headers only ever set dd-api-key/dd-application-key — it never reads cfg.access_token. Every other synthetics command routes through make_dd_client/apply_auth, which prefers the bearer.

The Datadog CI endpoints this command calls already accept OAuth2 server-side (verified in dogweb):

Endpoint	Accepts OAuth	Permission
GET /synthetics/ci/tunnel	yes	SYNTHETICS_WRITE or CREATE_EDIT_TRIGGER
POST /synthetics/tests/trigger/ci	yes	SYNTHETICS_WRITE or CREATE_EDIT_TRIGGER
GET /synthetics/ci/batch/{id}	yes	SYNTHETICS_READ

pup already requests synthetics_write/synthetics_read by default. So this was a client-side gap, not a backend limit — no backend change required, and it applies to --tunnel runs too.

Changes

• build_auth_headers (src/commands/synthetics.rs): prefer OAuth2 bearer, fall back to API + app keys, mirroring client::apply_auth.
• Clearer error when no auth is configured.
• Positive/negative tests for all three auth paths (bearer, key fallback, none).

Testing

• Added unit tests: bearer preferred, key fallback, no-auth error.