feat(auth): support an auth management key for disabled auth methods

[itaihanski]

Related Issues

https://github.com/descope/etc/issues/8683

Description

• Add an optional auth_management_key to the client config, resolved from
  DESCOPE_AUTH_MANAGEMENT_KEY when not set explicitly, and sent with every authentication
  request so methods with disabled public access can be used
• To facilitate this, extract Descope::HttpClient and instantiate it twice - one client per
  key - mirroring the approach taken in the Python and Go SDKs. Previously all requests went
  through a single receiver-less verb on one object, so there was no point at which the two keys
  could be told apart. Management modules now call mgmt_ prefixed verbs, making the key a
  property of the call site rather than something inferred from the request

Follow-ons from that refactor:

• Authentication requests no longer carry the management key. The @default_pswd fallback
  previously sent it on every authentication request that presented no token, which no other
  Descope SDK does. Callers relying on that must now set auth_management_key
• The Authorization header is built per request rather than merged into a shared @headers
  hash, so concurrent requests on one client cannot send each other's credentials
• timeout_seconds is now applied - it was never assigned, leaving every request without a
  timeout
• Everything after the project ID is masked in the debug log of the Authorization header,
  replacing a mask that only covered the last 10 characters
• extra_headers is passed on POST, PATCH and PUT, which request was dropping
• Removed post_file, post_form and delete_with_body, which passed an invalid verb to
  RestClient and had no call sites
• Updated .rubocop.yml and .rubocop_todo.yml for the installed RuboCop, which could not load
  its config on main

Must

• Tests
• Documentation

[shuni-bot]

🐕 Review complete — View session on Shuni Portal 🐾

[shuni-bot]

🐕 Suggested Reviewers

This PR introduces an authentication management key feature with significant refactoring of the HTTP client layer to support dual-key instantiation (mirroring Python and Go SDKs). The strategy prioritizes reviewers with: (1) broad experience across the management API surface area, (2) familiarity with the core HTTP client architecture being modified, and (3) exposure to documentation changes. ami-descope is selected as the primary reviewer due to extensive commits across tooling and documentation files, while dorsha provides deep coverage of the management API endpoints that now depend on the refactored HTTP client. guyp-descope adds focused expertise on the access_key management module directly impacted by auth management changes.

Reviewer	Reason
ami-descope	ami-descope has 14 commits across the repo including .rubocop.yml, .rubocop_todo.yml, and README.md—critical for this PR which modifies linting configuration and documentation. Their broad infrastructure-level commits make them ideal for reviewing the architectural changes to HttpClient extraction and dual instantiation.
dorsha	dorsha has 9 commits across 9 files including multiple management API modules (analytics, descoper, etc.) and core infrastructure files. This breadth of coverage across the management layer is essential for reviewing how the refactored HTTP client and auth_management_key integrate with all affected endpoints.
guyp-descope	guyp-descope has direct expertise in lib/descope/api/v1/management/access_key.rb, one of the modified files in this PR. Their focused commits provide specialized knowledge of the access key management functionality that interfaces with the new auth management key feature.

_{Suggested by Shuni based on git history and PR context. Names are not @-mentioned to avoid notifying anyone — request a review from whoever fits best.}

[shuni-bot]

🐕 Shuni's Review

Splits the HTTP layer into two clients so authentication requests carry the new auth_management_key while management requests keep the management key. The mgmt_* rename is complete and consistent across all 24 management modules and their specs — no bare verbs left behind. Good bones!

Sniffed out 2 issues:

• 1 🔴 CRITICAL: merge(nil) on extra_headers breaks enchanted_link_sign_in
• 1 🟢 LOW: new spec deletes/leaks DESCOPE_*_KEY env vars for the rest of the suite

Heads-up (not a finding): now that timeout_seconds is actually applied, long export_project/import_project calls hit the 60s default unless overridden.

See inline comments for details. Woof!

---

Declared coverage: FULL — 59/59 changed files reviewed.

[shuni-bot]

🐕 Review complete — View session on Shuni Portal 🐾

[shuni-bot]

🐕 Shuni's Review

Re-reviewed the delta since 150fa57 (5 files). Both prior findings are fixed and their threads are resolved: extra_headers is now guarded with || {}, the enchanted-link caller passes {}, and the spec's around hook snapshots and restores the env vars in ensure.

The two new regression examples drive a real client through the nil argument and enchanted-link sign-in — exactly the DummyClass blind spot — and the new README timeout section matches DEFAULT_TIMEOUT_SECONDS = 60.

No new issues sniffed out. Clean bill of health — good boy! Woof!

---

Declared coverage: PARTIAL — 5/61 changed files reviewed.