feat(profiles): manage gateway headers from the CLI

[sergiught]

📝 Summary

A profile can carry extra request headers, for deployments that put OpenFGA behind a gateway with its own header-based authentication. Nothing in the CLI could manage them: profiles set/profiles unset had no headers key, profiles show and profiles list never rendered them, and the only documented way to configure one was hand-editing config.toml.

$ ofga profiles set headers 'CF-Access-Client-Id: abc' 'CF-Access-Client-Secret: xyz'
● set headers on profile default

$ ofga profiles show
headers           CF-Access-Client-Id, CF-Access-Client-Secret (values hidden)

$ ofga profiles unset headers
● cleared headers on profile default

set headers takes every header in one command and replaces the profile's list, which keeps "set" meaning assign. Values are never rendered or emitted — a header configured here is a gateway credential, so the human view and --json (header_names) both report names only. Reserved headers (Authorization, which the SDK would silently drop) and malformed ones are rejected before anything is written to the config.

Also folded in: --scopes accepted commas in profiles add but spaces in profiles set scopes, for the same field. Both now take either, which is what OPENFGA_SCOPES has always done.

🏷 Type of change

• 🐛 Bug fix (non-breaking)
• ✨ Feature (non-breaking)
• 💥 Breaking change (users must update)
• ♻️ Refactor (no functional change)
• 📚 Docs only
• 🛠 Build / CI / tooling

✅ How to verify

make check

Driven end to end against an isolated config: setting two headers, replacing them, show in both human and JSON form, unset, rejection of Authorization: …, and that a scalar key like store_id still refuses a second value. The generated command reference is regenerated (make docs-reference).

📋 Checklist

• 🧪 Tests added or updated where it makes sense
• 📖 Docs updated (README / command --help / examples) if behavior changed — set/unset help and examples, plus the generated reference
• 🏷 PR title follows Conventional Commits
• 🟢 make check passes locally