feat(telemetry): auth flow events

[LorrisSaintGenez]

What

Step 2 of GROUT-349 — instruments the browser-based OAuth flow with funnel events. Stacked on #238

• RunOAuthFlow emits CLI Auth Started at entry (flow: login|signup, no_browser), then exactly one terminal event: CLI Auth Completed (duration_ms), CLI Auth Aborted (step) on user cancellation, or CLI Auth Failed (step, duration_ms, error_class).
• Steps recorded along the flow to locate drop-offs: browser_wait, code_exchange (inside auth.RunOAuth, which now takes an optional nil-safe FlowTracker), then apps_fetch, app_create/app_select, profile_configure.
• Automatic re-authentications (EnsureAuthenticated, ReauthenticateIfExpired) pass a nil tracker: they belong to the calling flow, not to an auth login funnel.
• New Event struct + typed constructors (AuthStarted, …) + nil-safe TrackEvent(ctx, Event) helper: call sites are one line and properties are compile-time consistent.
• identifyAuthenticatedUser uses the context's telemetry client; telemetry.IdentifyOnce is removed — it only existed because the client used to be closed before the command ran (fixed in feat(telemetry): flow events foundations #238).
• telemetrytest.RecordingClient: shared recording fake for flow event tests.

Included GROUT-351 — logout telemetry flow. Stacked on #239 (feat/auth-flow-events): it only needs the event catalog and TrackEvent helper from the auth step, nothing from the create/plan-change work.

• auth logout emits CLI Auth Logout (flow: logout) before auth.ClearToken(), while the user identifier is still attached to the telemetry metadata — the event is attributed to the user signing out.
• No event when already signed out (no logout actually happened).
• No Identify at logout time: Segment's identity graph has no concept of un-identifying — once an anonymousId is aliased to a userId, the mapping persists by design.
• Subsequent events automatically stop carrying userId: Track/Identify only set the field when the metadata has one, and after ClearToken() the next invocations load no token. Events fall back to anonymousId attribution, like a fresh install.

Test

# full flow: CLI Auth Started → CLI Auth Completed (+ Command Completed)
DEBUG=1 go run ./cmd/algolia auth login

# abort: Esc/Ctrl-C in the application selection prompt
# → CLI Auth Aborted {step: app_select}
DEBUG=1 go run ./cmd/algolia auth login

# signup variant: same events with flow=signup
DEBUG=1 go run ./cmd/algolia auth signup

# signed in: the final batch contains CLI Auth Logout {flow: logout}
DEBUG=1 go run ./cmd/algolia auth logout

# already signed out: no flow event
DEBUG=1 go run ./cmd/algolia auth logout

GROUT-351

GROUT-349

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 24 complexity · 0 duplication

Metric	Results
Complexity	24
Duplication	0

View in Codacy

_{TIP This summary will be updated as you push new changes.}