feat(synthetics): accept OAuth2 bearer for tests run

`synthetics tests run` was the only synthetics command that could not
authenticate with an OAuth2 session (`pup auth login`). Its
`build_auth_headers` hard-required DD_API_KEY + DD_APP_KEY and never read
`cfg.access_token`, unlike every sibling command which routes through
`make_dd_client`/`apply_auth` and prefers a bearer token.

The Datadog CI endpoints this command calls (`synthetics/ci/tunnel`,
`synthetics/tests/trigger/ci`, `synthetics/ci/batch/{id}`) already accept
OAuth2 bearer tokens with the `synthetics_write`/`synthetics_read` scopes,
which pup requests by default — so this was a client-side gap, not a
backend limitation.

- Prefer OAuth2 bearer, fall back to API + app keys, mirroring
  `client::apply_auth`.
- Clearer error when no auth is configured.
- Add positive/negative tests for the three auth paths.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jaluna0

src/commands/synthetics.rs

@@ -29,23 +29,29 @@ fn synthetics_intake_base_url(cfg: &Config) -> String {
 #[cfg(not(target_arch = "wasm32"))]
 fn build_auth_headers(cfg: &Config) -> anyhow::Result<reqwest::header::HeaderMap> {
     use reqwest::header::{HeaderMap, HeaderName, HeaderValue};
-    let api_key = cfg
-        .api_key
-        .as_ref()
-        .ok_or_else(|| anyhow::anyhow!("DD_API_KEY is required for 'synthetics tests run'"))?;
-    let app_key = cfg
-        .app_key
-        .as_ref()
-        .ok_or_else(|| anyhow::anyhow!("DD_APP_KEY is required for 'synthetics tests run'"))?;
     let mut headers = HeaderMap::new();
-    headers.insert(
-        HeaderName::from_static("dd-api-key"),
-        HeaderValue::from_str(api_key)?,
-    );
-    headers.insert(
-        HeaderName::from_static("dd-application-key"),
-        HeaderValue::from_str(app_key)?,
-    );
+
+    // Prefer OAuth2 bearer token, falling back to API + app keys.
+    if let Some(token) = cfg.access_token.as_ref() {
+        headers.insert(
+            reqwest::header::AUTHORIZATION,
+            HeaderValue::from_str(&format!("Bearer {token}"))?,
+        );
+    } else if let (Some(api_key), Some(app_key)) = (cfg.api_key.as_ref(), cfg.app_key.as_ref()) {
+        headers.insert(
+            HeaderName::from_static("dd-api-key"),
+            HeaderValue::from_str(api_key)?,
+        );
+        headers.insert(
+            HeaderName::from_static("dd-application-key"),
+            HeaderValue::from_str(app_key)?,
+        );
+    } else {
+        anyhow::bail!(
+            "'synthetics tests run' requires authentication: run 'pup auth login' or set DD_API_KEY and DD_APP_KEY"
+        );
+    }
+
     headers.insert(
         reqwest::header::USER_AGENT,
         HeaderValue::from_str(&crate::useragent::get())?,
@@ -959,6 +965,41 @@ mod tests {
         cleanup_env();
     }
 
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn test_build_auth_headers_prefers_bearer() {
+        let mut cfg = test_config("http://unused.local");
+        cfg.access_token = Some("tok-123".into());
+        let headers = super::build_auth_headers(&cfg).expect("bearer headers");
+        assert_eq!(headers.get("authorization").unwrap(), "Bearer tok-123");
+        assert!(headers.get("dd-api-key").is_none());
+        assert!(headers.get("dd-application-key").is_none());
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn test_build_auth_headers_falls_back_to_api_keys() {
+        let mut cfg = test_config("http://unused.local");
+        cfg.access_token = None;
+        cfg.api_key = Some("api-1".into());
+        cfg.app_key = Some("app-1".into());
+        let headers = super::build_auth_headers(&cfg).expect("api-key headers");
+        assert_eq!(headers.get("dd-api-key").unwrap(), "api-1");
+        assert_eq!(headers.get("dd-application-key").unwrap(), "app-1");
+        assert!(headers.get("authorization").is_none());
+    }
+
+    #[cfg(not(target_arch = "wasm32"))]
+    #[test]
+    fn test_build_auth_headers_requires_some_auth() {
+        let mut cfg = test_config("http://unused.local");
+        cfg.access_token = None;
+        cfg.api_key = None;
+        cfg.app_key = None;
+        let err = super::build_auth_headers(&cfg).expect_err("should require auth");
+        assert!(err.to_string().contains("requires authentication"));
+    }
+
     async fn server_mock_delete(s: &mut mockito::Server) -> mockito::Mock {
         s.mock("DELETE", mockito::Matcher::Any)
             .with_status(204)