Fix registry auth: use source org for token, suggest login on 403

RegistrySource now uses its own Org field for token lookup instead of
detecting from git remote. This fixes auth when pulling from multiple
orgs' registries.

Catalog search now detects auth-related failures (403, token errors)
and suggests running apx auth login.

Author: daniel-garcia

cmd/apx/commands/search.go

@@ -75,6 +75,14 @@ func searchAction(cmd *cobra.Command, args []string) error {
 		Tag:       tag,
 	})
 	if err != nil {
+		// If the error is auth-related, suggest running apx auth login.
+		errStr := err.Error()
+		if strings.Contains(errStr, "auth") || strings.Contains(errStr, "403") ||
+			strings.Contains(errStr, "token") || strings.Contains(errStr, "user app") {
+			ui.Error("Catalog search failed due to authentication.")
+			ui.Info("Run `apx auth login` to authenticate and discover catalogs.")
+			return err
+		}
 		ui.Error("Failed to search catalog: %v", err)
 		return err
 	}

internal/catalog/registry.go

@@ -140,15 +140,34 @@ func (r *RegistrySource) httpClient() *http.Client {
 }
 
 // ghToken gets a GitHub token for GHCR authentication.
+// Uses the RegistrySource's Org to look up the correct token, rather
+// than guessing from the current git remote.
 func (r *RegistrySource) ghToken() (string, error) {
 	if r.GHTokenFn != nil {
 		return r.GHTokenFn()
 	}
-	return ghAuthToken()
+
+	// Use the registry's own org for token lookup.
+	org := r.Org
+	if org == "" {
+		// Fallback: detect from git remote.
+		var err error
+		org, err = githubauth.DetectOrg()
+		if err != nil {
+			return "", fmt.Errorf("cannot detect GitHub org: %w", err)
+		}
+	}
+
+	token, err := githubauth.EnsureToken(org)
+	if err != nil {
+		return "", fmt.Errorf("GitHub auth for org %q failed: %w", org, err)
+	}
+	return token, nil
 }
 
-// ghAuthToken returns a GitHub token for GHCR auth.
-// Uses the githubauth package (device flow + token cache) instead of `gh auth token`.
+// ghAuthToken returns a GitHub token for GHCR auth using the current
+// directory's org. Used by DiscoverRegistries which doesn't have an
+// org-specific RegistrySource yet.
 var ghAuthToken = ghAuthTokenReal
 
 func ghAuthTokenReal() (string, error) {