feat(auth): remember last workspace and skip Auth0 workspace prompt on login

[filipmyllari]

What

Interactive logins currently always route the user through Auth0's workspace-id prompt because the authorize URL never includes an organization parameter. This PR makes the CLI remember the workspace after a successful login and pass it along next time:

• After a successful token exchange, the Auth0 organization identifier (org_id claim, falling back to https://confidence.dev/org_login_id) is persisted to $TMPDIR/confidence_organization, next to the existing token files, with the same 0600 mode.
• Subsequent interactive logins pass it as the organization parameter in the authorize URL, so Auth0 skips the workspace prompt. Signup stays org-less — the signup client is unaffected.
• Escape hatches:
  • CONFIDENCE_ORGANIZATION env var overrides the remembered value (to log into a different workspace).
  • If Auth0 returns an error on the callback while an organization was passed (e.g. a stale org), the callback responds with a 302 back to the authorize endpoint without the organization parameter — one retry instead of failing hard.
• scripts/clean-dev-env.sh --auth now also removes the remembered organization.

Why now

This composes with the planned Auth0 "Prompt for Credentials" flip: after that flip Auth0 itself no longer prompts for a workspace id, but passing organization still skips the post-login workspace picker — so remembering the last workspace keeps repeat logins one-click either way.

Tests

New __tests__/lib/auth.test.ts exercises the real PKCE flow (real callback server, MSW for the token exchange, mocked browser opener) and covers:

• no organization on first login
• org persisted after login and included in the authorize URL on the next login (org_id and org_login_id fallback)
• CONFIDENCE_ORGANIZATION env override
• signup never includes organization
• retry without organization when Auth0 returns an error

pnpm qa (typecheck + lint + 114 tests) and pnpm test:e2e (36 tests) pass.

🤖 Generated with Claude Code

[bespoyasov]

Nice