fix(api): isolate environment PATs from stored OAuth

Tien Rayrequested to merge
ray.tien0907/cli:fix/8214-env-pat-oauth-context into main

Summary

  • Treat GITLAB_TOKEN and GITLAB_ACCESS_TOKEN as PAT authentication unless GLAB_IS_OAUTH2=true explicitly marks the environment credential as OAuth.
  • Prevent environment PAT requests from inheriting stored OAuth refresh state or writing refreshed credentials.
  • Preserve stored OAuth and explicit environment OAuth behavior, with regression coverage for request headers, refresh calls, and config mutation.

Testing

  • go test -race -count=1 ./internal/api
  • go vet ./internal/api
  • git diff --check origin/main...HEAD
  • pre-push hooks: build, generated checks, lint (0 issues), and 3,092 tests (8 skipped, 0 failed)

AI assistance

Implemented and verified with OpenAI Codex assistance.

Closes #8214 (closed)

Merge request reports