fix(auth): pass username argument to OAuth2Flow in auth oauth2 command (#60)

The `auth oauth2` command always passes an empty string to
`OAuth2Flow()`, ignoring any positional username argument. This forces
the flow through `fetchUsername()` which calls `GET /2/users/me` — an
endpoint that has been returning 403 for many developers since the
March 2026 platform regression.

When a username is provided (`xurl auth oauth2 alice`), pass it
through so `OAuth2Flow` skips the broken `/2/users/me` lookup and
stores the token under the given username directly.

Fixes #47

Author: chilang

cli/auth.go

@@ -56,10 +56,15 @@ func createAuthBearerCmd(a *auth.Auth) *cobra.Command {
 
 func createAuthOAuth2Cmd(a *auth.Auth) *cobra.Command {
 	cmd := &cobra.Command{
-		Use:   "oauth2",
+		Use:   "oauth2 [USERNAME]",
 		Short: "Configure OAuth2 authentication",
+		Args:  cobra.MaximumNArgs(1),
 		Run: func(cmd *cobra.Command, args []string) {
-			_, err := a.OAuth2Flow("")
+			username := ""
+			if len(args) > 0 {
+				username = args[0]
+			}
+			_, err := a.OAuth2Flow(username)
 			if err != nil {
 				fmt.Println("OAuth2 authentication failed:", err)
 				os.Exit(1)