Remove OAuth from the dev server and use DD_OAUTH_ACCESS_TOKEN passed by the apps CLI

[oliverli]

Summary

Implements the dev-server section of the RFC "OAuth multi org credential management in apps CLI" (Confluence: RFC OAuth multi org credential management in apps CLI → Integration with the Vite build plugin's dev server).

@datadog/apps-cli now owns the OAuth flow: login, token storage, org selection, and refresh. The CLI passes the access token to the dev server via DD_OAUTH_ACCESS_TOKEN when it spawns it through datadog-apps dev. The plugin no longer duplicates any OAuth/session logic.

Changes

Authentication precedence (auth.ts): getAuthenticatedRequest() reads credentials from the environment in this order:

1. DD_API_KEY/DATADOG_API_KEY + DD_APP_KEY/DATADOG_APP_KEY → API-key auth
2. DD_OAUTH_ACCESS_TOKEN/DATADOG_OAUTH_ACCESS_TOKEN → Bearer auth
3. Otherwise: throw MissingAuthenticationError with guidance to start the dev server with datadog-apps dev

Removed:

• apps.authOverrides option, the AuthMethod type, and auth-method resolution in validate.ts.
• DD_APPS_AUTH_METHOD / DATADOG_APPS_AUTH_METHOD env vars.
• The doOAuthRequest dependency from the dev-server path (browser auth, keychain storage, token refresh all live in the CLI now).

Added:

• OAUTH_ACCESS_TOKEN to the core OVERRIDE_VARIABLES registry (both DD_ and DATADOG_ prefixes).
• README section "Development server authentication" that documents the precedence and the datadog-apps dev flow.

Notes for reviewers

• The dev server warns once at startup when no credentials are configured; individual /__dd/executeAction requests return 400 with the same guidance.
• Test isolation: Jest's setupAfterEnv runs cleanEnv() after collection, so dev-server.test.ts captures the authenticated request at collection time and the bearer test pins its token in the test body. All tests pass individually and in any order.

Verification

• All apps plugin unit suites pass (22 suites / 235 tests), including each affected test in isolation.
• Apps plugin typecheck and lint pass.
• Repo-wide search shows no remaining references to authOverrides, AuthMethod, or APPS_AUTH_METHOD.

[oliverli]

Warning

This pull request is not mergeable via GitHub because a downstack PR is open. Once all requirements are satisfied, merge this PR as a stack on Graphite.
Learn more

• Remove OAuth from the dev server and use DD_OAUTH_ACCESS_TOKEN passed by the apps CLI #495 👈 (View in Graphite)
• Make the apps plugin build-only: move upload, publish, and OAuth to apps-cli #494
• master

This stack of pull requests is managed by Graphite. Learn more about stacking.