fix: --app flag now correctly switches credentials for all subcommands

[NOVA-Openclaw]

Summary

Fixes #38 — the --app persistent flag was not switching credentials for shortcut subcommands (post, reply, whoami, mentions, etc.). All requests used the default app's tokens regardless of --app.

Root Cause

Three interconnected bugs:

1. WithAppName() conditionally updated credentials

clientID/clientSecret were only set if empty. Since Auth is initialized with the default app's non-empty credentials, the override never applied.

2. Token retrieval methods ignored Auth.appName

GetOAuth1Tokens(), GetFirstOAuth2Token(), GetBearerToken() all called ResolveApp("") which always returned the default app, ignoring Auth.appName.

3. getAuthHeader() auto-selection bypassed Auth methods

The auth cascade in api/client.go called TokenStore methods directly without passing the app name.

Fix

• WithAppName() now unconditionally updates clientID/clientSecret from the named app
• All token retrieval methods in Auth now use ForApp(a.appName) variants
• Added AppName() accessor so api/client.go can pass the app name through the auto-selection cascade
• OAuth2Flow() and RefreshOAuth2Token() save/retrieve tokens for the correct app

Changes

• auth/auth.go — Fixed WithAppName(), all Get*Header() methods, RefreshOAuth2Token(), OAuth2Flow()
• api/client.go — getAuthHeader() now uses ForApp variants with auth's app name
• auth/auth_test.go — 18 new test cases covering happy path, edge cases, error conditions, and root-cause-specific scenarios
• api/client_test.go — Integration test for auth cascade with app override

Test Results

All existing tests continue to pass. 18 new tests added covering:

• Multi-app token switching (OAuth1, OAuth2, Bearer)
• Edge cases (empty app name, same-as-default, sequential switching)
• Error conditions (non-existent app, missing token types)
• Root cause verification (unconditional credential overwrite, auth cascade, token save target)

Verified end-to-end with a real multi-app setup (read-write app + read-only app) against the live X API.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[santiagomed]

Thanks @NOVA-Openclaw! Can you sign the CLA?

[drQedwards]

Hey @NOVA-Openclaw 👋

The CLA check is the only thing blocking this PR. Please sign it here:

➡️ https://cla-assistant.io/xdevplatform/xurl?pullRequest=39

Once signed, the check will update automatically. If it stays pending after signing, hit recheck:
https://cla-assistant.io/check/xdevplatform/xurl?pullRequest=39

cc @santiagomed @drQedwards

[drQedwards]

@santiagomed we got to stop meeting like this. I feel like I am the only one who signs their CLAs

[drQedwards]

#53 #50 #48 #51

[santiagomed]

Thanks for the excellent work on this, @NOVA-Openclaw — your root cause analysis in issue #38 was instrumental. We merged #46 which covers the same fixes plus a few additional spots (cli/auth.go save/clear commands and webhook CRC). Closing this one in favor of that.