feat: add --profile, auth switch, auth list and per-account logout

[l2ysho]

Note

TL;DR — Adds a way to choose between stored accounts. Commands that call the API take --profile. apify auth switch sets the active account, apify auth list shows all stored accounts offline, and apify logout takes --profile or --all. APIFY_TOKEN still has priority, so --profile and auth switch fail while it is set.

Stacked on #1458 (base claude/multi-account-login-1386). Change the base when #1434 → #1450 → #1458 are merged.

Closes #1384. Part of #1297.

Change

• static enableProfileFlag on ApifyCommand adds --profile <name|userId>, the same way enableJsonFlag adds --json. It is set on 46 commands that call the API: actors, builds, datasets, key-value-stores, runs, task, api, info, run, auth token and create. It is not on init, actor * or mcp install.
• create gets the flag even though the issue calls it offline: with --source github|gitlab|bitbucket it calls the API to set up the Git repository.
• --profile matches a user ID, then name ?? username. So profiles migrated from v1 (which have name: null) match by username.
• An unknown profile fails with exit code InvalidInput and lists the stored accounts. --profile fails with InvalidInput when APIFY_TOKEN is set, also when the two tokens are the same. The selection applies to one command only, so telemetry does not change.
• auth switch [profile]:
  • Prompts when you give no argument, and fails in a non-interactive shell.
  • Refuses an account that has no stored token.
  • Fails while APIFY_TOKEN is set.
  • Calls updateUserId().
• auth list [--json]: shows name, user ID, personal or organization, last login and storage. It marks the active account and shows a warning when APIFY_TOKEN overrides it. It makes no network calls.
• logout --profile <name> removes that account and keeps the active one. logout --all asks for confirmation first; --yes skips the prompt. Removing an account that is not active keeps the legacy unkeyed keyring entries.
• When a token is rejected, the message names the account: The stored API token for my-org was rejected. Run "apify login" to log in to my-org again. A selected account with no token gives No API token is stored for my-org. The CLI no longer says "not logged in" in that case.
• info shows token source: --profile flag and a profile row. run --profile passes that account's token and proxy password to the Actor process.
• docs/ regenerated.

Verification

• pnpm run test:local — 711 passed, 4 skipped (65 files). New file test/local/commands/auth-profiles.test.ts covers the checks in the issue's Verification list.
• pnpm run lint, pnpm run format, pnpm run build — clean. pnpm run update-docs — adds auth list and auth switch, and adds --profile to the commands that opt in.
• I ran node dist/apify.js by hand with a temporary auth folder that held two profiles. I tried auth list (table and --json), an unknown --profile, APIFY_TOKEN with --profile, auth switch with no argument from a pipe, APIFY_TOKEN with auth switch, logout --profile, and logout --all with and without --yes. All gave the expected output and exit codes.
• pnpm run test:api not run: no token in this environment.
• Install size unchanged: no dependency was added or removed.

Left out

• No APIFY_PROFILE variable and no profile renaming, as the issue says.
• auth switch and logout --profile take the account as an argument or flag only. There is no ls alias for auth list.

🤖 Generated with Claude Code