feat: Run one command as another session

[scotwells]

Summary

You can now run a single command as any signed-in account by passing --session or setting DATUM_SESSION, and the active session stays as it was.

The value is a session name or an email signed in on one endpoint, the command uses that session's last context unless you name a scope, and plugins run this way act as that session too.

An email on several endpoints, or a value that matches nothing, fails and lists the sessions to choose from, while a stale DATUM_SESSION left in your shell only stops commands that need a session. This builds on the endpoint switching from #301.

$ datumctl whoami --session swells@datum.net@api.staging.env.datum.net
User:         Scot Wells (swells@datum.net)
Session:      swells@datum.net@api.staging.env.datum.net (from --session; the active session is unchanged)
Endpoint:     api.staging.env.datum.net
Context:      datum/datum-cloud
Organization: datum
Project:      datum-cloud

$ DATUM_SESSION=alice@example.com datumctl whoami
User:         Alice Example (alice@example.com)
Session:      alice@example.com@api.datum.net (from DATUM_SESSION; the active session is unchanged)
Context:      (none)
  Pass --project or --organization to choose a scope for this session.

$ datumctl whoami --session swells@datum.net
error: swells@datum.net is signed in on more than one endpoint, so --session swells@datum.net is ambiguous.
Name the session instead:
  --session swells@datum.net@api.datum.net
  --session swells@datum.net@api.staging.env.datum.net

$ DATUM_SESSION=gone@example.com datumctl version --client
Client Version: v0.0.0-master+$Format:%H$
Kustomize Version: v5.7.1

$ DATUM_SESSION=gone@example.com datumctl whoami
error: No session matches DATUM_SESSION gone@example.com.
Valid sessions:
  swells@datum.net@api.datum.net
  swells@datum.net@api.staging.env.datum.net
Pass a session name, or an email signed in on one endpoint. Run 'datumctl auth list' to see accounts.

$ datumctl auth switch alice@example.com --session swells@datum.net@api.staging.env.datum.net
error: 'datumctl auth switch' changes the active session, so it does not accept --session.
Run it without --session. It also ignores DATUM_SESSION.

Test plan

• A command with --session or DATUM_SESSION shows that account and its last context, and the next plain command shows the active account again
• A shared email or unknown value fails and lists the valid sessions, while a stale DATUM_SESSION leaves version, help, completion and plugin listing working
• A plugin run with --session receives that session and its API host, and a datumctl it calls acts as that session
• login, logout, auth switch and ctx use refuse --session, and auth get-token --session <name> works as before

Fixes #302

🤖 Generated with Claude Code