fix: --app flag now correctly switches credentials for all subcommands

[NOVA-Openclaw]

Summary

Fixes #38 — the --app persistent flag was not switching credentials for shortcut subcommands (post, reply, whoami, mentions, etc.). All requests used the default app's tokens regardless of --app.

Root Cause

Three interconnected bugs:

1. WithAppName() conditionally updated credentials

clientID/clientSecret were only set if empty. Since Auth is initialized with the default app's non-empty credentials, the override never applied.

2. Token retrieval methods ignored Auth.appName

GetOAuth1Tokens(), GetFirstOAuth2Token(), GetBearerToken() all called ResolveApp("") which always returned the default app, ignoring Auth.appName.

3. getAuthHeader() auto-selection bypassed Auth methods

The auth cascade in api/client.go called TokenStore methods directly without passing the app name.

Fix

• WithAppName() now unconditionally updates clientID/clientSecret from the named app
• All token retrieval methods in Auth now use ForApp(a.appName) variants
• Added AppName() accessor so api/client.go can pass the app name through the auto-selection cascade
• OAuth2Flow() and RefreshOAuth2Token() save/retrieve tokens for the correct app

Changes

• auth/auth.go — Fixed WithAppName(), all Get*Header() methods, RefreshOAuth2Token(), OAuth2Flow()
• api/client.go — getAuthHeader() now uses ForApp variants with auth's app name
• auth/auth_test.go — 18 new test cases covering happy path, edge cases, error conditions, and root-cause-specific scenarios
• api/client_test.go — Integration test for auth cascade with app override

Test Results

All existing tests continue to pass. 18 new tests added covering:

• Multi-app token switching (OAuth1, OAuth2, Bearer)
• Edge cases (empty app name, same-as-default, sequential switching)
• Error conditions (non-existent app, missing token types)
• Root cause verification (unconditional credential overwrite, auth cascade, token save target)

Verified end-to-end with a real multi-app setup (read-write app + read-only app) against the live X API.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[santiagomed]

Thanks @NOVA-Openclaw! Can you sign the CLA?