Support OAuth2 client credentials in 'spice cloud login' (spiceai#10586)

* support OAuth2 client credentials in 'spice cloud login'

* fix: address lint and security review issues in cloud login OAuth2 flow

- Fix doc comment missing backticks on OAuth2 in client.rs
- Replace fragile base_url string replace with oauth_base_url() helper
  that correctly handles both api.spice.ai and {env}-api.spice.ai hosts
- Redact client_secret in LoginArgs Debug impl to prevent accidental leakage

* formatting

* fix: add backticks to doc comments for clippy::doc_markdown

* fix: remove Debug derive from OAuth types containing secrets

OAuthTokenRequest contains client_secret and OAuthTokenResponse contains
access_token; deriving Debug risks accidental credential disclosure.

* feat(cloud): enhance login methods and OAuth token handling

* feat(cloud): update login methods and enhance documentation for cloud login command

Co-authored-by: Copilot <copilot@github.com>

* fix(docs): adjust formatting in cloud login documentation table

* feat(cloud): improve login handling and add tests for login methods

* fix(cloud): correct documentation formatting and improve item selection handling in login prompt

* docs(cloud-login): apply review feedback fixes

- Remove `spice cloud login token` and `spice cloud login client` alias
  examples, since the corresponding Clap subcommands do not declare aliases.
- Reconcile the OAuth host resolution section with the wire formats: the
  exchange polling endpoint (`/v1/auth/device/exchange`) uses the API base
  URL, not the non-API OAuth host.
- Replace "fifth method" with "another method" since the doc currently
  describes three methods.

Addresses copilot review feedback.

* fix(cloud-login): resolve env vars in chooser path

The chooser path constructs PatLoginArgs / ApiLoginArgs with all fields set
to None, bypassing Clap's env-var resolution. Users with SPICE_CLOUD_PAT,
SPICE_CLOUD_CLIENT_ID, or SPICE_CLOUD_CLIENT_SECRET set were prompted
interactively even when the env vars contained valid values.

`resolve_string_or_prompt_with_terminal` now falls back to reading the
configured env var directly before prompting, so chooser-based PAT/API
logins respect env configuration consistently with the explicit-method
paths. Adds a unit test exercising the env-var fallback.

Addresses copilot review feedback.

* style: collapse nested if to satisfy clippy::collapsible_if

Combines the env-var read and non-empty check into a single
`if let && condition` form to match the repo's clippy::pedantic config.

---------

Co-authored-by: Luke Kim <80174+lukekim@users.noreply.github.com>
Co-authored-by: Copilot <copilot@github.com>
Co-authored-by: claudespice <claude@spice.ai>

Author: 4 people

bin/spice/src/commands/cloud/client.rs

@@ -44,6 +44,11 @@ impl CloudClient {
     /// Create a new authenticated cloud client.
     pub fn new() -> Result<Self> {
         let token = get_auth_token()?;
+        Self::with_token(token)
+    }
+
+    /// Create a new authenticated cloud client with an explicit bearer token.
+    pub fn with_token(token: impl Into<String>) -> Result<Self> {
         Ok(Self {
             inner: InnerCloudClient::new(&get_base_url())
                 .map_err(into_cli)?
@@ -68,6 +73,31 @@ impl CloudClient {
         self.inner.exchange_code(auth_code).await.map_err(into_cli)
     }
 
+    /// Exchange `OAuth2` client credentials for an access token.
+    pub async fn exchange_client_credentials(
+        &self,
+        client_id: &str,
+        client_secret: &str,
+    ) -> Result<String> {
+        let response = self
+            .inner
+            .exchange_client_credentials(client_id, client_secret)
+            .await
+            .map_err(into_cli)?;
+
+        if response.token_type.eq_ignore_ascii_case("bearer") {
+            Ok(response.access_token)
+        } else {
+            InvalidResponseSnafu {
+                message: format!(
+                    "Failed to exchange client credentials: unsupported OAuth token type '{}'; expected 'Bearer'",
+                    response.token_type
+                ),
+            }
+            .fail()
+        }
+    }
+
     /// Get the auth context for the current user.
     pub async fn get_auth_context(&self) -> Result<AuthContext> {
         self.inner.get_auth_context().await.map_err(into_cli)