feat(auth): add support for user-based auth, public-api-server

[rektdeckard]

https://linear.app/livekit/issue/DEVX-575/build-cli-poc-for-user-auth-and-list-projects
https://linear.app/livekit/issue/DEVX-577/implement-dual-mode-auth-routing-in-the-cli

• Adds experimental user-based authentication to begin implementing the new Public API service
  • Adds client codegen for the protobuf spec (for the moment these are copied wholesale from the public-api-server repo -- we will consume them as library/SDK when stable).
  • Implements lk cloud auth flow for user sessions.
  • Implements lk project list, lk project get, lk project create, lk project update, and lk project delete commands using the new client behind --experimental-auth flag.
  • Cache user's projects for recall with the --project <my-project> flag
    • On cache miss, the project cache is refreshed, meaning you don't have to synchronize anything to run commands against a new project.
  • Adds nudge to reauthenticate with new method if you have not already (and don't explicitly specify to use --legacy-auth)
• Migrates to use mage as the default build tool. CMake is still supported as a fallback.

Architecture

The CLI config file now stores a list of authenticated User credentials, including name, session token, and a cache of their projects. This lives alongside the existing Project credentials, and either can be used interchangeably for supported commands. Once the Public API is complete, this will be the default authentication mode for all commands.

Commands that support user-based authentication are routed through the API client in pkg/public. To run client codegen:

mage generate

Usage

A hidden global --experimental-auth flag gates all experimental API variants of commands. Unimplemented commands return an error. To authenticate using the new flow against staging:

lk cloud auth \
  --experimental-auth \
  --server-url https://cloud-api-server-public.ochicago1a.staging.livekit.app \
  --dashboard-url https://cloud.staging.livekit.io

To run new versions of the commands:

lk project list --experimental-auth

The default API URL can be overridden with the --experimental-api-url flag when running the API server locally:

lk project list --experimental-auth --experimental-api-url "http://localhost:8000"

Note that at the moment, Public API Server will return "unimplemented" for all commands.