feat(auth): support pre-subcommand tw --user <ref> <subcommand>

[scottlovegrove]

Summary

cli-core's auth attachers (attachLogoutCommand, attachStatusCommand, attachTokenViewCommand) already declare a per-command --user <ref> flag, but commander has no root-level --user option, so the global form tw --user 42 auth status was rejected at parse time. This PR completes the plumbing started by the cli-core 0.16 adoption (#226).

• src/index.ts — warm the global-args cache via getRequestedUserRef() before mutating argv (so the original --user value is captured), then strip the pre-subcommand --user from process.argv via cli-core's stripUserFlag so commander sees a clean argv. Per-command --user (after the subcommand name) survives the strip and reaches commander unchanged.
• src/lib/global-args.ts — expose getRequestedUserRef() reading store.get().user from the existing lazy parser cache. The user field was already part of TwGlobalArgs; this just adds an accessor.
• src/commands/auth/store-wrap.ts (new) — withUserRefAware(store, requestedRef) adapter built with Object.create(store) and overriding only active / clear so future TwistTokenStore methods inherit automatically. The captured ref is substituted whenever the attachers call active(ref) / clear(ref) without an explicit ref; per-command --user wins because the explicit ref short-circuits the substitution. Pure adapter — does not reach into global state.
• src/commands/auth/index.ts — resolve getRequestedUserRef() once at registration and hand it to withUserRefAware; wire the wrapper to logout / status / token view (login does not accept --user).
• Skill docs (src/lib/skills/content.ts + regenerated skills/twist-cli/SKILL.md) — document the global form narrowed to the three auth subcommands that actually honour it.

Single-user note: until the keyring TokenStore + migrateLegacyAuth land (#2+#5 in the migration plan), the only valid --user <ref> is the lone stored account — any other ref surfaces ACCOUNT_NOT_FOUND. The plumbing being in place now means those follow-up PRs ship without extra wiring.

Test plan

• npm run type-check
• npm run lint:check
• npm test — 3 new wiring tests at the user-visible boundary (global ref flows into auth token view, global ref flows into auth status, wrong global ref on auth logout surfaces ACCOUNT_NOT_FOUND despite cli-core's swallow-active-error contract); 614 total pass
• npm run build
• tw --user 1 doctor --offline — global flag accepted at root, doctor runs
• tw --user 1 auth --help — strip works; commander does not reject --user
• Manual end-to-end after tw auth login:
  • tw --user 1 auth status → success
  • tw auth status --user 1 → success (regression)
  • tw --user 999 auth status → ACCOUNT_NOT_FOUND
  • tw --user 999 auth status --user 1 → success (per-command wins)
  • tw --user 1 auth token view → prints stored token

🤖 Generated with Claude Code

[doistbot]

This PR successfully introduces global --user flag support for auth subcommands by stripping it before Commander evaluation and mapping the resolved reference through a new token store adapter. This is a great step toward fuller cli-core integration that cleanly sets up the infrastructure for upcoming multi-account features. There are a few areas that could use refinement, including tightening flag validation so unsupported commands do not silently accept the flag, decoupling the store adapter from global state, optimizing double-lookups during logout, expanding test coverage for the root parser and status command, and ensuring the skill documentation precisely matches the implemented scope.

_{Share Feedback • Review Logs}

[doist-release-bot]

🎉 This PR is included in version 2.39.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀

[henningmu]

Nice ✅

(this might make my prior comment about cli-core moot 😅)