auth: CLI auth manager + `panto auth` subcommands

Add src/auth_manager.zig (turn-time resolution: load→login→refresh→exchange→
build credential, patch live config) and `panto auth status|login|logout`
subcommands with a line-based device-code presenter. Add config_file.loadFromString.

1 files changed, 12 insertions, 0 deletions

diff --git a/src/config_file.zig b/src/config_file.zig
index 19e4bb1..1277661 100644
--- a/src/config_file.zig
+++ b/src/config_file.zig
@@ -398,6 +398,18 @@ pub fn userConfigPath(allocator: Allocator, environ_map: *const std.process.Envi
     return error.NoHomeDirectory;
 }
 
+/// Resolve a `Config` from a single in-memory TOML string. Convenience for
+/// tests and tooling that already hold the document text.
+pub fn loadFromString(
+    allocator: Allocator,
+    environ_map: *const std.process.Environ.Map,
+    source: []const u8,
+) Error!Config {
+    const doc = parseDoc(allocator, source) catch return error.InvalidConfigToml;
+    defer doc.deinit();
+    return resolve(allocator, environ_map, doc.root);
+}
+
 /// Load from explicit layer paths, lowest precedence first. Useful for
 /// tests. Missing files are skipped.
 pub fn loadFromPaths(