feat(auth): align login with set-token; stop persisting client credentials

[howar31]

Two commits, two concerns (merge with a merge commit to keep both on main):

feat(auth): align auth login with set-token + stop persisting client credentials

• auth login now shares one interactive model with set-token via a shared promptCtx: when a field is missing and stdin is a TTY, it prompts for profile / workspace / client id / client secret (secret entered hidden). Flags remain the unchanged agent/script path.
• Adds --non-interactive; non-interactive defaults the profile to default + prints a hint, and errors clearly (exit 1) when client id/secret are missing — never blocks headless callers.
• Stops persisting the OAuth client_id / client_secret — they were written to config.toml but only ever used transiently for the token exchange. Removed the profile fields (+ encrypt/decrypt + status handling); existing stored values drop on the next config write. Only user_token / bot_token are stored, encrypted at rest.
• Regenerates the slk-auth skill; syncs README "Credential storage" + SPEC.

docs: Team setup guide

Documents sharing one Slack app across a team (one app, per-user tokens, owner one-time setup, per-teammate auth login, all-or-nothing consent, secret-as-shared-credential).

Verification

• TDD: new login tests (interactive mint, non-interactive default+hint, missing-creds error, no client-cred persistence) + set-token regression — all green. go vet, full uncached go test ./..., build all pass.

🤖 Generated with Claude Code

[gemini-code-assist]

Code Review

This pull request updates the authentication flow to ensure that OAuth client_id and client_secret are used transiently and not persisted in the configuration file. It introduces a unified promptCtx for interactive field resolution across auth set-token and auth login commands, adds a --non-interactive flag to the login command, and updates documentation and tests accordingly. Feedback was provided regarding the derivation of file descriptors for terminal-dependent operations to ensure correct behavior when input streams are redirected.

[gemini-code-assist]

According to the general rules, terminal-dependent operations should derive the file descriptor from the reader itself if it is an *os.File, rather than defaulting to os.Stdin.Fd(). This ensures correct behavior when input streams are redirected. Additionally, interactivity should only be enabled if the input source is actually a terminal and a valid *os.File descriptor is available.

	var fd int
	f, ok := in.(*os.File)
	if ok {
		fd = int(f.Fd())
	} else {
		fd = -1
	}
	return promptCtx{
		in:          in,
		errw:        cmd.ErrOrStderr(),
		fd:          fd,
		interactive: !nonInteractive && ok && isTerminal(fd),
	}

References

1. When performing terminal-dependent operations (e.g., checking if a reader is a terminal), derive the file descriptor from the reader itself if it is an *os.File, rather than defaulting to os.Stdin.Fd(). This ensures correct behavior when input streams are redirected.

[howar31]

Addressed in the amended commit. The fd now falls back to -1 (not os.Stdin.Fd()) for a non-*os.File reader, so a redirected/in-memory input can't borrow os.Stdin's terminal status — isTerminal(-1) is false. I did not add the explicit ok && guard on interactive: the tests stub isTerminal over an in-memory reader to exercise the prompt path, and an ok guard would force interactive to false there regardless of the stub. With fd = -1 the isTerminal(fd) check already yields false for a non-file reader in production, so the guard is redundant for real usage (and cmd.InOrStdin() is os.Stdin, an *os.File, in production anyway).