feat(config): one-time config.toml migration to state.toml + keychain

[LorrisSaintGenez]

What

GROUT-363: one-time, first-run migration of the legacy config.toml profiles into the new storage model (state.toml + OS keychain). Squashed stack of #245, #246 and #247.

• Trigger: at startup, when config.toml exists and state.toml doesn't — state.toml is only written on success, so its absence doubles as the "not migrated yet" marker and an aborted run retries on the next command. A failed migration never blocks the command (DEBUG-only log).
• Per profile: api_key (+ crawler_api_key if set) goes to the OS keychain under the profile's application ID; one state.toml entry per application with alias = <profile name>; current_application_id = the default = true profile's application; api_key_uuid left empty for legacy keys.
• Atomicity: keychain first, state.toml last (temp + rename). An empty config.toml still writes an empty state.toml so the trigger turns off.
• Per profile (non-secret): search_hosts and crawler_user_id move to the application's state.toml entry; GetSearchHosts/GetCrawlerUserID read them for the resolved application first, falling back to config.toml while both models coexist
• Hardening: an undecodable profile (root-level scalar, wrong field type) is skipped with a log instead of hitting ConfiguredProfiles's log.Fatalf (which bricked every command at startup); an unparseable config.toml aborts the migration instead of marking it done with an empty state.toml
• Skip rules: no application_id or empty api_key → skip + log; profiles sharing the same application_id → the default profile wins, others logged as conflicts; admin_api_key never migrated, one log line pointing to ALGOLIA_ADMIN_API_KEY / --api-key.

config.toml itself is never modified.

Test

# on a machine with legacy config.toml profiles
rm -f ~/.config/algolia/state.toml
go run ./cmd/algolia indices list      # any command triggers the migration once
cat ~/.config/algolia/state.toml       # aliases + current_application_id
# macOS: the migrated key is in the keychain (replace <APP_ID>; go-keyring stores it base64-encoded)
security find-generic-password -s algolia-cli -a "app:<APP_ID>" -w | sed "s/^go-keyring-base64://" | base64 -d
# run it again: no re-migration, no logs
go run ./cmd/algolia indices list

GROUT-363

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

🟢 Metrics 43 complexity · 12 duplication

Metric	Results
Complexity	43
Duplication	12

View in Codacy

_{TIP This summary will be updated as you push new changes.}