test: pin auth behavior before the multi-account refactor

[l2ysho]

Note

Stage-0 of #1297. Test-only, no src/ changes. Closes #1387.
The keyring backend — the default for real users — was never reached through a command, and the auth commands had 0% coverage in test:local. Both are now covered on both backends. Every new test was mutation-verified.

Why

• useAuthSetup and run-cli both pin APIFY_DISABLE_KEYRING=1, so no test ever hit the keyring path.
• src/commands/auth/* ran only under test:api / test:e2e, which need TEST_USER_TOKEN.
• getLoggedClient is a second auth.json writer, separate from credentials.ts. Its keyring branch — strip token, strip proxy.password, drop proxy when empty — had no test.
• 6 tests in Stage-0: Verify tests and coverage #1387 were mutation-verified as unable to fail.

What

• test/__setup__/keyring-mock.ts — shared @napi-rs/keyring fake. Exposes keyringStore, keyringFailures, keyringSetKeys.
• useKeyringBackend() in useAuthSetup.ts — describe-scoped, so one file covers both backends. Throws if the file forgot the mock, rather than writing to the developer's real OS keyring.
• test/local/commands/auth.test.ts — 11 tests. Stubs apify-client, so login / logout / auth token run in test:local on both backends.
• credentials.test.ts — 23 → 42 tests: writeFileSync spy (F1/F2 could not fail before), 0o600, keyring write failures for setToken and setProxyPassword, the stale-credentials throw, resolveToken via getApifyClientOptions, the persisted secretsBackend marker branch.
• e2e auth token compares stdout to the token, not to length > 0 (F5).
• CONTRIBUTING documents the new hook.

All 8 exit criteria in #1387 are met, plus F3 and the account-switch merge that Stage-1 rewrites.

Notes

• The issue says resolveToken has an APIFY_TOKEN branch. It does not — src/lib/utils.ts:132 is existingToken ?? (ensureMigrated(), getToken()). That variable is read in actor.ts, mcp/install.ts and actor/charge.ts instead.
• Install size unchanged — no dependency added, and the shared mock is a test file.
• auth.test.ts:116 asserts that fields from the old account survive a re-login. That is current behavior, pinned deliberately, and flagged in a comment.

Verification

test:local 585 passed / 4 skipped. Lint, format, build, test typecheck clean. test:api not run locally — no token here; the useAuthSetup.ts change is one added export.

🤖 Generated with Claude Code