Auth + API key creation when using bt setup

[ViaDézo1er / cedric (viadezo1er)]

The OAuth-related changes, isolated from the wizard.

• ensure_auth rewrite (credential recovery flow, is_missing_credential_error)
• maybe_create_api_key_for_oauth (auto-create key, print-once)
• login_interactive_oauth made pub(crate)
• #[allow(dead_code)] on login_interactive_api_key (or just remove it)
• Remove login_interactive (the old method-chooser)
• Auth output tweaks (warning→info, spacing)

Part 3 of #94

[github-actions]

Latest downloadable build artifacts for this PR commit 294b778826fc:

• Workflow run: https://github.com/braintrustdata/bt/actions/runs/24485254247
• Download all artifacts (GitHub CLI): gh run download 24485254247 --repo braintrustdata/bt
• Installers are published from main automatically. To publish one for a PR branch, run release-canary manually via workflow_dispatch.

Available artifact names

• ``artifacts-build-global
• ``artifacts-build-local-x86_64-apple-darwin
• ``artifacts-build-local-x86_64-pc-windows-msvc
• ``artifacts-build-local-x86_64-unknown-linux-musl
• ``artifacts-build-local-x86_64-unknown-linux-gnu
• ``artifacts-build-local-aarch64-unknown-linux-musl
• ``artifacts-build-local-aarch64-apple-darwin
• ``artifacts-build-local-aarch64-unknown-linux-gnu
• ``artifacts-plan-dist-manifest
• ``cargo-dist-cache

[ViaDézo1er / cedric (viadezo1er)]

Auth spec

For case where the user should be prompted but bt setup runs in non interactive mode (--no-input, --json), stop the setup.
-o/--org/-p/--project/--profile/'~/.bt/config.json' (config.json configures org and project fields)and their respective env variables: flags > env variables > config file in case of conflict between 2 indicators of the same field (like --org and BRAINTRUST_ORG_NAME).
When populating a profile , use the same behavior as if 'bt auth login' was run. If the profile to use is not specified:

• For OAuth login, if a profile with the same auth_kind, api_url, app_url, org_name, user_name and email already exist (profile name does not matter), just update the oauth_client_id, oauth_access_expires_at and the stored secret without prompting the user.
  • If there are multiple OAuth profiles matching org/user, update the one that has the largest oauth_access_expires_at (ie the most recently created/updated).
• For API key login, if a profile with the same auth_kind, api_url, and org_name already exist (profile name does not matter), create a new profile with the new api_key_hint and stored secret.

When trying to login with OAuth, first try to use the cached OAuth token, if it's missing/stale and there's a valid refresh token use it to get a new OAuth token, else browser-based OAuth workflow.
When a variable should be checked but there is an error (for example, --profile incorrect-profile-name), the setup fails and print an error.
A removed/revoked API key is treated as if it does not match any org.
In case of network error, 5xx from Braintrust, wrong API call, print an error and stop.
To check if a project is in an org, list the projects of the org with

curl --request GET \
  --url https://api.braintrust.dev/v1/project \
  --header 'Authorization: Bearer <token>'

then search the returned project list for the requested project name.

'goto aaa' means 'continue the program the line after the [aaa] line'.
Like in python, if there is no else statement just continue to the next line.
'If XXX is passed' means 'if XXX is in flags or env variables or config file'.
Decision tree:

if need authentication and instrumenting:
  All authentication use cases need an API key
  if API key passed:
    if profile passed:
      goto profile-passed-1
    else if org passed:
      if prefer-profile passed and 0 of the available profile's org matches the passed org:
        fail, end
      if API key's org matches passed org:
        [project-passed-1]
        if project is passed:
          if the project is in the passed org:
            use API key, end
          else:
            fail, end
        else:
          use API key, end
      else:
        OAuth, create API key, goto project-passed-1
    else if prefer-profile passed:
      if the number of available profile is 0:
        use API key, add a profile as if bt auth login with API key, end
      else if 1:
        if API key's org and profile's org match:
          use API key, end
        else:
          OAuth, create API key, end
      else if number of profiles' org matching the API key's org is 0:
        OAuth, create API key, end
      else if >=1:
        use API key, end
  goto no-org-no-profile-prefer-profile
end

[no-org-no-profile-prefer-profile]
if API key passed:
  if project is in API key's org:
    use API key, end
OAuth, create API key, end

[profile-passed-1]
if org passed:
  [profile-passed-2]
  if org and profile's org match:
    if API key passed:
      if the API key's org matches the profile's org:
        if project is passed and does not exist in org:
          fail, end
        else:
          use API key, end
    OAuth login.
    if project is passed and is not in the passed org:
      fail, end
    else:
      create API key, end
  else:
    fail, end
else:
  consider that passed org is the same as the profile's org
  goto profile-passed-2