Refactor cuiman authentication configuration

[forman]

Closes #176.

This PR separates proprietary login from standards-based OAuth2 authentication and makes the configuration shape explicit per authentication mechanism.

See also required eo-tools/eozilla-app#76

Changes

• Replaced the flat authentication configuration with nested, discriminated auth models:
  • none
  • basic
  • token
  • login
  • oauth2
  • api-key
• Added typed OAuth2GrantType support for password and client_credentials.
• Renamed ambiguous fields:
  • auth_url → login_url or token_url
  • token → access_token
  • token_header → access_token_header
• Updated cuiman configure, CLI options, environment-variable handling, token refresh, and client integration.
• Updated the Eozilla App service payload contract to recognize the renamed camel-case fields and apply Basic, token, and API-key request headers.

Configuration migration

Compatibility is intentionally limited:

• Legacy flat none, basic, token, and api-key file configurations are converted when read.

• A legacy flat login configuration containing auth_url fails with:

  Legacy configuration format detected, please run 'cuiman configure'

This avoids incorrectly treating a proprietary login flow as OAuth2.

Validation

• cuiman: 303 tests passed; Ruff and Mypy passed.
• eozilla-app: 164 tests passed; TypeScript typecheck and ESLint passed.

Checklist (strike out non-applicable):

• Changes documented in CHANGES.md
• Related issue exists and is referred to in the PR description and CHANGES.md
• Added docstrings and API docs for any new/modified user-facing classes and functions
• Changes/features documented in docs/*
• Unit-tests adapted/added for changes/features
• Test coverage remains or increases (target 100%)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!