docs(lstk hotfix): update CLI reference to v0.21.0

[gtsiolis]

Brings the lstk CLI reference docs up to date with the v0.21.0 release of localstack/lstk, catching up the full backlog from the last-documented v0.19.0. The v0.20.1 sync (#833) was closed unmerged, so this PR covers the whole v0.19.0 → v0.21.0 range (v0.20.0, v0.20.1, and v0.21.0) verified against the CLI at the v0.21.0 tag.

Reference pages in scope

• src/content/docs/aws/developer-tools/running-localstack/lstk.mdx
• src/content/docs/azure/developer-tools/lstk.mdx

There are no shared lstk components yet, so each page carries its own reference content and both are kept in sync.

What changed

Authentication order reversed (localstack/lstk#415) — LOCALSTACK_AUTH_TOKEN now takes precedence over a token stored in the keyring, so a per-invocation token overrides a previous lstk login without logging out first. The docs previously stated the opposite; the resolution list, the caution box, and the environment-variable table were corrected.

--endpoint-url / LSTK_ENDPOINT_URL (localstack/lstk#419) — new "Targeting an external emulator" section, plus rows in the Global options and Environment variables tables. Documents the accepted commands (aws, az, terraform/tf, cdk, sam, snapshot save/load/remove, snapshot list s3://…, reset, status), the commands that reject it (start, bare lstk, stop, restart, logs, volume), http/https handling, and emulator-type auto-detection.

container_name config field (localstack/lstk#420) — added to the default config.toml snippet and the config field reference table (also reported as MAIN_CONTAINER_NAME).

snapshot versions + version-pinned refs (localstack/lstk#430) — new snapshot versions subsection; the subcommand count went five → six; load/show now document the pod:<name>:<version> suffix, and it is noted that save/remove/versions/s3:// reject a version suffix.

Container runtime auto-detection (localstack/lstk#399, #422) — reworked the runtime-discovery paragraph (Docker Desktop, Rancher Desktop, Colima, OrbStack, Lima, Podman; DOCKER_HOST → context → Linux-Docker-preferred → socket probe → SDK default), rewrote "Port 443 already in use" (a busy 443 is dropped with a warning by default rather than fatal) and "Docker is not running" (full runtime set + tailored start command). Fixed the Azure page's Port 443 example, which used type = "aws" → type = "azure".

Smaller items — lstk logs streams to the terminal scrollback (localstack/lstk#418); lstk az consumes its own --non-interactive rather than forwarding it (localstack/lstk#431); a note that lstk aws <TAB> completes AWS commands (localstack/lstk#424); the binary self-update verifies its SHA-256 checksum (localstack/lstk#410).

Cleanup noticed on the way — removed a duplicated #### setup azure subsection on the AWS page.

Deliberately not included

• License plan in the header (Show license plan in header for self-validating emulators lstk#283) — this changes a TUI header label, not the command/flag/config reference surface (which does not document the header label today), so it was left out to avoid introducing a new concept in a sync PR.
• expose_ports (Add expose_ports config option to publish extra container ports lstk#433) — merged after the v0.21.0 tag, so it is out of scope here; it is tracked separately in DOC-392.

Review

Advisable. Most edits are mechanical reference updates, but a few touch user-facing wording worth a glance: the reversed auth-token precedence (a behavior change users may have scripted around) and the rewritten "Port 443" drop-with-warning framing.

Closes DOC-393

Cc @localstack/devx for visibility and any corrections.

---

Generated by Claude Code

[cloudflare-workers-and-pages]

Deploying localstack-docs with    Cloudflare Pages

Latest commit:	1eba5da
Status:	✅  Deploy successful!
Preview URL:	https://80d47a24.localstack-docs.pages.dev
Branch Preview URL:	https://claude-affectionate-edison-3.localstack-docs.pages.dev

View logs

[gtsiolis]

The Validate Refs check is expected to be red here. That job only passes when the head branch is named aws-docs-*/snowflake-docs-*, and this is the release-independent lstk hotfix flow (a claude/* branch into main), the same setup as the previous lstk reference hotfixes (#830, #833, #788).

Please don't retarget the base to make it green — retargeting mid-merge is what sent #774 to the wrong branch. Merge via the usual hotfix path. Cloudflare Pages (the check that actually builds the docs) passed.

---

Generated by Claude Code