Add PAT (Personal Access Token) auth support (CRED-2147)

Add DD_PAT environment variable support to NewDefaultContext(). When set,
the PAT value is used as the appKeyAuth key (sent as DD-APPLICATION-KEY
header), taking precedence over DD_APP_KEY when both are set.

Changes:
- api/datadog/configuration.go: Add DD_PAT env var handling after DD_APP_KEY
- .generator/src/generator/templates/configuration.j2: Same change in template
- tests/api/client_test.go: Add 4 unit tests for PAT auth scenarios

Author: tausman

.generator/src/generator/templates/configuration.j2

@@ -400,6 +400,9 @@ func NewDefaultContext(ctx context.Context) context.Context {
 	}
 
 	{%- endfor %}
+	if pat, ok := os.LookupEnv("DD_PAT"); ok {
+		keys["appKeyAuth"] = APIKey{Key: pat}
+	}
 	ctx = context.WithValue(
 		ctx,
 		ContextAPIKeys,

api/datadog/configuration.go

@@ -1064,6 +1064,9 @@ func NewDefaultContext(ctx context.Context) context.Context {
 	if apiKey, ok := os.LookupEnv("DD_APP_KEY"); ok {
 		keys["appKeyAuth"] = APIKey{Key: apiKey}
 	}
+	if pat, ok := os.LookupEnv("DD_PAT"); ok {
+		keys["appKeyAuth"] = APIKey{Key: pat}
+	}
 	ctx = context.WithValue(
 		ctx,
 		ContextAPIKeys,

tests/api/client_test.go

@@ -155,3 +155,56 @@ func TestApiAppKeyAuthenticate(t *testing.T) {
 	assert.Equal(t, headers["DD-API-KEY"], apiKey)
 	assert.Equal(t, headers["DD-APPLICATION-KEY"], appKey)
 }
+
+func TestPATAuthentication(t *testing.T) {
+	apiKey := "api-key"
+	pat := "ddapp_test-pat-token"
+	keys := map[string]datadog.APIKey{
+		"apiKeyAuth": {Key: apiKey},
+		"appKeyAuth": {Key: pat},
+	}
+	testAuthCtx := context.WithValue(
+		context.Background(),
+		datadog.ContextAPIKeys,
+		keys,
+	)
+
+	headers := map[string]string{}
+	datadog.SetAuthKeys(
+		testAuthCtx,
+		&headers,
+		[2]string{"apiKeyAuth", "DD-API-KEY"},
+		[2]string{"appKeyAuth", "DD-APPLICATION-KEY"},
+	)
+	assert.Equal(t, apiKey, headers["DD-API-KEY"])
+	assert.Equal(t, pat, headers["DD-APPLICATION-KEY"])
+}
+
+func TestNewDefaultContextWithPAT(t *testing.T) {
+	t.Setenv("DD_API_KEY", "test-api-key")
+	t.Setenv("DD_PAT", "ddapp_test-pat-token")
+
+	ctx := datadog.NewDefaultContext(context.Background())
+	keys := ctx.Value(datadog.ContextAPIKeys).(map[string]datadog.APIKey)
+	assert.Equal(t, "test-api-key", keys["apiKeyAuth"].Key)
+	assert.Equal(t, "ddapp_test-pat-token", keys["appKeyAuth"].Key)
+}
+
+func TestNewDefaultContextPATOverridesAppKey(t *testing.T) {
+	t.Setenv("DD_API_KEY", "test-api-key")
+	t.Setenv("DD_APP_KEY", "test-app-key")
+	t.Setenv("DD_PAT", "ddapp_test-pat-token")
+
+	ctx := datadog.NewDefaultContext(context.Background())
+	keys := ctx.Value(datadog.ContextAPIKeys).(map[string]datadog.APIKey)
+	assert.Equal(t, "ddapp_test-pat-token", keys["appKeyAuth"].Key)
+}
+
+func TestNewDefaultContextAppKeyWithoutPAT(t *testing.T) {
+	t.Setenv("DD_API_KEY", "test-api-key")
+	t.Setenv("DD_APP_KEY", "test-app-key")
+
+	ctx := datadog.NewDefaultContext(context.Background())
+	keys := ctx.Value(datadog.ContextAPIKeys).(map[string]datadog.APIKey)
+	assert.Equal(t, "test-app-key", keys["appKeyAuth"].Key)
+}