Adopt profile package for multi-account auth (#78)

* Add profile-based multi-account auth with basecamp/cli profile package

Replace custom Config.Accounts/AddAccount/RemoveAccount with profile.Store
backed by ~/.config/fizzy/config.json. Credential keys change from
"token:<account>" to "profile:<name>" via credstore.

Key changes in root.go:
- Add profile.Store initialization and --profile global flag
- resolveProfile() uses profile.Resolve() 6-step chain
- Profile settings (layer 3) outrank local/global YAML config (4-5)
  but yield to env vars (layer 2) and flags (layer 1)
- Credential helpers: credsSaveProfileToken, credsLoadProfileToken,
  credsDeleteProfileToken with legacy key migration
- ensureProfile() does delete-then-create for upsert semantics

Config precedence: flags > env vars > profiles > local config > global > defaults

* Rewrite auth commands for profile-based credential storage

All auth subcommands now operate on profiles instead of accounts:
- auth login: saves to "profile:<name>" credstore key, creates profile
- auth logout: deletes profile and "profile:<name>" key
- auth logout --all: cleans all three legacy key formats
  ("profile:<name>", "token:<account>", bare "token")
- auth list: reads from profile.Store.List()
- auth switch: calls profiles.SetDefault(), updates YAML config
- auth status: shows profile key in output

Tests rewritten with profile.Store injection via SetTestProfiles().
Covers: invalid --profile flag errors, env var precedence over profile
settings, ensureProfile upsert, logout --all legacy key cleanup.

* Wire setup and signup to profile store

setup: create profile via ensureProfile() + profiles.SetDefault()
signup: saveSignupConfig() creates profile instead of AddAccount()
Both use credsSaveProfileToken for credential storage.

* Update docs and surface for --profile flag and precedence chain

- README/AGENTS: 5-level precedence, --profile flag, FIZZY_ACCOUNT deprecation
- SKILL.md: --account → --profile, precedence includes profile layer
- SURFACE.txt: regenerated with --profile replacing --account globally

* Add integration test for full precedence chain

TestPrecedenceChainIntegration wires up real config files, credstore,
and profile store, then runs config.Load() → resolveProfile() →
resolveToken() → flag override — the same sequence as PersistentPreRunE.

Three cases lock the contract:
- profile outranks YAML config for APIURL and board
- env vars beat profile for all fields
- --api-url flag beats env and profile

* Fix board JSON escaping and auth switch legacy token fallback

- ensureProfile: use json.Marshal for board value instead of manual quoting
- auth switch: fall back to credsLoadLegacyToken when profile key missing

* Update SKILL.md terminology: account → profile throughout

Replace remaining "account" references in auth command examples
and troubleshooting sections with "profile" terminology.

---------

Co-authored-by: Jeremy Daer <jeremy@37signals.com>

Author: robzolkos

AGENTS.md

@@ -47,10 +47,13 @@ E2E environment variables:
 ## Configuration
 
 The CLI reads config from multiple sources with this priority:
-1. CLI flags (`--token`, `--account`, `--api-url`, `--board`)
-2. Environment variables (`FIZZY_TOKEN`, `FIZZY_ACCOUNT`, `FIZZY_API_URL`, `FIZZY_BOARD`)
-3. Local project config (`.fizzy.yaml`)
-4. Global config (`~/.config/fizzy/config.yaml` or `~/.fizzy/config.yaml`)
+1. CLI flags (`--token`, `--profile`, `--api-url`, `--board`)
+2. Environment variables (`FIZZY_TOKEN`, `FIZZY_PROFILE`, `FIZZY_API_URL`, `FIZZY_BOARD`)
+3. Named profile settings (base URL, board from `~/.config/fizzy/config.json`)
+4. Local project config (`.fizzy.yaml`)
+5. Global config (`~/.config/fizzy/config.yaml` or `~/.fizzy/config.yaml`)
+
+`FIZZY_ACCOUNT` is accepted as a deprecated alias for `FIZZY_PROFILE`.
 
 ## Authentication
 

README.md

@@ -120,16 +120,21 @@ This interactive command installs the [SKILL.md](skills/fizzy/SKILL.md) file to
 
 ```
 ~/.config/fizzy/              # Global config
-└── config.yaml               #   Token, account, API URL, default board
+├── config.json               #   Named profiles (account, base URL, board)
+├── config.yaml               #   Legacy/fallback settings
+└── credentials/              #   Fallback token storage (when keyring unavailable)
 
 .fizzy.yaml                   # Per-repo (local config overrides global)
 ```
 
 Configuration priority (highest to lowest):
-1. CLI flags (`--token`, `--account`, `--api-url`, `--board`)
-2. Environment variables (`FIZZY_TOKEN`, `FIZZY_ACCOUNT`, `FIZZY_API_URL`, `FIZZY_BOARD`)
-3. Local project config (`.fizzy.yaml`)
-4. Global config (`~/.config/fizzy/config.yaml` or `~/.fizzy/config.yaml`)
+1. CLI flags (`--token`, `--profile`, `--api-url`, `--board`)
+2. Environment variables (`FIZZY_TOKEN`, `FIZZY_PROFILE`, `FIZZY_API_URL`, `FIZZY_BOARD`)
+3. Named profile settings (base URL, board from `config.json`)
+4. Local project config (`.fizzy.yaml`)
+5. Global config (`~/.config/fizzy/config.yaml` or `~/.fizzy/config.yaml`)
+
+`FIZZY_ACCOUNT` is accepted as a deprecated alias for `FIZZY_PROFILE`.
 
 ## Development