feat(auth): add support for user-based auth, public-api-server

[rektdeckard]

https://linear.app/livekit/issue/DEVX-575/build-cli-poc-for-user-auth-and-list-projects
https://linear.app/livekit/issue/DEVX-577/implement-dual-mode-auth-routing-in-the-cli

• Adds experimental user-based authentication to begin implementing the new Public API service
  • Adds client codegen for the OpenAPI spec
  • Implements lk cloud auth flow for user sessions.
  • Implements lk project list, lk project get, lk project create, lk project update, and lk project delete commands using the new client behind --experimental-auth flag.
  • Implements net-new lk workspace, lk user, lk simulation commands.
  • Cache user's projects for recall with the --project <my-project> flag
    • On cache miss, the project cache is refreshed, meaning you don't have to synchronize anything to run commands against a new project.
  • Adds nudge to reauthenticate with new method if you have not already (and don't explicitly specify to use --legacy-auth)

Architecture

The CLI config file now stores a list of authenticated User credentials, including name, session token, and a cache of their projects. This lives alongside the existing Project credentials, and either can be used interchangeably for supported commands. Once the Public API is complete, this will be the default authentication mode for all commands.

Commands that support user-based authentication are routed through the API client in pkg/public. To run client codegen:

go generate -tags oapigen ./pkg/public/...

Usage

A hidden global --experimental-auth flag gates all experimental API variants of commands. Unimplemented commands return an error. To authenticate using the new flow against staging:

lk cloud auth \
  --experimental-auth \
  --server-url https://cloud-api-server-public.ochicago1a.staging.livekit.app \
  --dashboard-url https://cloud.staging.livekit.io

To run new versions of the commands:

lk project list --experimental-auth

The default API URL can be overridden with the --experimental-api-url flag when running the API server locally:

lk project list --experimental-auth --experimental-api-url "http://localhost:8000"

Note that at the moment, prod Public API Server will return "unimplemented" for all commands.

[Topherhindman]

overall i think this is v good. couple of preguntas

[Topherhindman]

can we add some tests for this file?

[rektdeckard]

done