fix(cli): honor global --base-url and --api-key in auth commands

[yudelevi]

What

auth login and auth status ignored the global --base-url and --api-key options. Every other command builds its client via get_client(ctx), which reads what the root callback stashes on ctx.obj; these two took no ctx and called build_client(...) directly.

The visible damage — auth status reporting success against a host it never contacted:

$ discolike --base-url http://127.0.0.1:9 auth status
{"source": "env", "api_key": "…isco", "valid": true}       # before

$ discolike --base-url http://127.0.0.1:9 account usage    # control, always correct
{"error": "APIConnectionError", "message": "Connection refused"}

--api-key was ignored too, so there was no way to verify a key before auth login wrote it to disk.

After

$ discolike --base-url http://127.0.0.1:9 auth status
{"error": "APIConnectionError", "message": "Connection to DiscoLike API failed: [Errno 61] Connection refused", "status_code": null}

$ discolike --api-key dk_bogus_should_fail auth status
{"error": "AuthenticationError", "message": "Invalid API Key or Session", "status_code": 401}

$ discolike auth status
{"source": "env", "api_key": "…isco", "valid": true}

Behaviour notes for reviewers

auth status gains a third source value: option. It previously emitted only env or config. A key passed on the command line is now reported as option. This is additive, but anything parsing source should know. The distinction has to come from click's parameter source — the global --api-key is declared with envvar="DISCOLIKE_API_KEY", so ctx.obj["api_key"] is already populated from the environment and the value alone cannot tell the two apart.

auth login's prompt is deliberately preserved. An ambient DISCOLIKE_API_KEY does not skip the prompt — only an explicit flag does. Letting the env var through would mean anyone holding a production key in their environment silently persists it to config.json while trying to save a different one. Two regression tests cover this; one fails if that guard is removed.

Verification

• 149 tests pass (147 before, +2 regression tests for the login prompt behaviour).
• The new --base-url / --api-key tests fail against the pre-fix code.
• ruff check and ruff format --check clean.
• Reproduction commands above run against a real build.

Related

Found while writing the CLI reference for the docs site, which had to document this as a caution. That caution comes out once this lands.

Greptile Summary

The PR makes auth login and auth status honor global API-key and base-URL options while preserving the rule that environment-provided keys do not bypass the login prompt.

• Adds parameter-source tracking to distinguish explicit global keys from environment keys.
• Centralizes credential verification with global base-URL forwarding.
• Adds regression coverage for key precedence, source reporting, prompting, and client construction.
• Documents the behavioral change in the changelog.

Confidence Score: 5/5

The PR appears safe to merge with no actionable correctness, security, or compatibility issues identified.

The changed auth paths forward both supported global client settings, select credentials according to the documented precedence, and are covered by targeted regression tests.

Important Files Changed

Filename	Overview
packages/discolike-cli/src/discolike_cli/auth.py	Correctly distinguishes explicit and environment-provided global keys, forwards the selected key and base URL for verification, and preserves login prompt behavior.
packages/discolike-cli/tests/test_auth.py	Adds focused regression coverage for base-URL forwarding, key precedence, source reporting, and environment-key prompt behavior.
packages/discolike-cli/tests/conftest.py	Extends the mocked client factory to record keyword arguments without changing its transport behavior.
CHANGELOG.md	Accurately documents the fixed option handling and additive option status source.

_{Reviews (1): Last reviewed commit: "fix(cli): honor global --base-url and --..." | Re-trigger Greptile}