auth: Enrich auth profiles output with validation failure reason

[janniklasrose]

Changes

databricks auth profiles now explains why a profile isn't valid, instead of an overloaded valid: false.

• Text table — the Valid column renders three states: YES (green, validated), NO (red, validation failed for any reason), and ?? (grey, validation skipped via --skip-validate). No extra columns.
• JSON (--output json) — keeps the boolean valid field (backwards compatible) and adds a valid_reason string that explains a valid: false result: the full underlying error when validation failed, or a skip note under --skip-validate. valid_reason is empty only on success.

Why

A single valid: false was overloaded across very different conditions — expired token, no network, 5xx from the workspace, malformed config, missing host. Users seeing red NO everywhere had no actionable signal. The model here keeps the display dead simple (YES / NO / ??) while valid_reason in JSON carries the full detail for anyone who needs to debug or script against it. Every real error is NO; ?? is reserved for the all-or-nothing --skip-validate, so there's no confusing "NO" on a profile that was never checked.

This PR is intentionally scoped to the output change. A separate follow-up adds a per-profile validation timeout — auth profiles currently stalls for ~5 minutes on a host the SDK retries (connection refused, connect/TLS timeout, retriable 5xx) — with its own regression test.

Tests

• cmd/auth/profiles_test.go:
  • TestProfileLoadStatusMatrix — via httptest: 401, 403, 500, and InvalidConfig all report valid: false with a non-empty valid_reason; --skip-validate reports valid: false with the skip note.
  • Existing SPOG / no-discovery routing tests assert against Valid / ValidReason.
• Acceptance test acceptance/cmd/auth/profiles/server-error/ — a 5xx from the validation endpoint produces valid: false with the backend error echoed in valid_reason, exercising the JSON serialization end-to-end.
• Regenerated affected acceptance outputs (the existing profiles / spog-account test plus auth/login, auth/logout, auth/switch, and auth/host-metadata-cache tests that include auth profiles output).
• Merged latest origin/main; fixed the InvalidConfig fixture for the SDK bump that replaced the experimental_is_unified_host flag with host-metadata host_type.

This pull request and its description were written by Isaac, an AI coding agent.

[github-actions]

Approval status: pending

/cmd/auth/ - needs approval

Files: cmd/auth/profiles.go, cmd/auth/profiles_test.go
Suggested: @simonfaltum
Also eligible: @mihaimitrea-db, @tanmay-db, @renaudhartert-db, @tejaskochar-db, @hectorcast-db, @parthban-db, @Divyansh-db, @chrisst, @rauchy

General files (require maintainer)

7 files changed
Based on git history:

• @simonfaltum -- recent work in cmd/auth/, acceptance/cmd/auth/profiles/, acceptance/cmd/auth/switch/nominal/

_{Any maintainer (@andrewnester, @anton-107, @denik, @pietern, @shreyas-goenka, @simonfaltum, @renaudhartert-db, @lennartkats-db) can approve all areas.
See OWNERS for ownership rules.}