feat: cache JWT on disk to respect issuance rate limit

[adamkrim]

Problem

Each CLI invocation (e.g. a Terraform command) is a new process that mints a fresh JWT via checkAPIToken. A few commands per hour exceed the API's JWT issuance rate limit (15/hour per user and per IP).

Solution

Persist the issued JWT and reuse it until it nears expiry, so we only call checkAPIToken when there's no valid token.

• Storage: user-private file under os.UserCacheDir()/elestio/, mode 0600, filename = sha256(email:apiKey) so accounts don't collide and raw credentials never hit disk.
• Expiry: read from the token's own exp claim (golang-jwt/jwt/v5, ParseUnverified — the server stays the authority on validity). Reused only while >5 min from expiry.
• Self-healing: on a 401 the cache is dropped and we sign in once more, so a server-revoked token recovers automatically (the auth endpoint itself is excluded to avoid a loop).
• Escape hatch: ELESTIO_DISABLE_JWT_CACHE=1 disables caching entirely.

Caching is best-effort: any cache read/write error falls back to a normal sign-in.

Tests

cache_test.go covers exp parsing, round-trip, per-credential isolation, the expiry margin, deletion, and the disable flag. go build, go vet, and tests pass.

Notes for reviewers / security

• Bearer token on disk is user-private (0600), shorter-lived than the API key already stored in env/config, and never written to Terraform state or the repo.
• Please confirm the JWT lifetime so we can validate the 5-min refresh margin.

🤖 Generated with Claude Code