fix: scope all token operations to the active app (#46)

The --app flag was silently ignored across the codebase. While WithAppName
correctly stored the app name, every subsequent token read, write, and clear
still resolved to the default app.

- fix token reads in auth.go (GetOAuth1Header, GetOAuth2Header,
  RefreshOAuth2Token, GetBearerTokenHeader) to use ForApp variants
- fix OAuth2 token saves in OAuth2Flow and RefreshOAuth2Token to write
  back to the named app instead of the default
- fix WithAppName to replace credentials even when env vars were already set
- fix auto-detection probes in api/client.go (getAuthHeader) to check
  the named app for available tokens
- fix cli/auth.go save and clear commands (bearer, oauth1, clear) to
  operate on the named app
- fix cli/webhook.go CRC validation to read OAuth1 secret from the named app
- add AppName() getter on Auth to expose appName to the api package
- add tests covering token isolation per app, credential override, refresh
  token save target, and default-app regression guards

Signed-off-by: Santiago Medina <santiagm08@gmail.com>
Co-authored-by: Santiago Medina <santiagm08@gmail.com>