feat: make token login additive across accounts

[l2ysho]

Note

TL;DR — apify login now adds an account instead of replacing the stored one, and makes it active. apify logout removes the active account and activates the most recently logged-in one that remains.

Stacked on #1450 (base claude/secret-storage-v2-1420), which is stacked on #1434. Retarget once those land.

Closes #1386. Part of #1297.

Change

• replaceStoredAccount() → upsertProfile(). It keeps other profiles. A stored profile keeps its own secretsBackend and file secrets on re-login. loggedInAt is refreshed on every login.
• Profile name = username, falling back to the user ID.
• The file-level secretsBackend is set only on a new file. A new or re-logged profile whose backend differs records its own, so a login with APIFY_DISABLE_KEYRING=1 cannot redirect other accounts' reads.
• Login runs the migrations first, so a v1 account survives logging in to a second one. The v1 backup is kept, since that account is still stored.
• Login no longer clears the outgoing account's keyed keyring entries. On an account switch it still clears the legacy unkeyed entries and top-level file secrets, so a later keying pass cannot file them under the new account.
• removeActiveProfile() picks the next active profile by loggedInAt (null last) and returns the removed and new active profile. Telemetry user ID follows the new active one.
• Messages: with one account, nothing changes. Login adds Other stored accounts: A. when others exist. Logout says You are logged out of B. A is now the active account.
• Logout description updated; docs/ regenerated.

Verification

• pnpm run test:local — 687 passed, 4 skipped (64 files).
• pnpm run lint, pnpm run format, pnpm run build — clean. pnpm run update-docs — logout description only.
• pnpm run test:api not run — no token in this environment.
• New tests cover the issue's cases: two logins → two profiles, second active; re-login → updated in place and active; logout with two → other active with message; logout with one → logged out; v1 file then second login. Also: next active by loggedInAt, keyring entries kept per account, logout clearing only the outgoing account, and a keyring-disabled login leaving other accounts on the keyring.
• Install size unchanged — no dependency added or removed.

Left out

• --profile, auth switch, auth list, logout --profile / --all — Stage-3 (Stage-3: Multi-account UX #1384).
• Profiles migrated from v1 keep name: null until their next login. Stage-3 may want the migration to set it.
• login -m console becomes additive through tryToLogin, with no dedicated tests, as the issue says.

🤖 Generated with Claude Code