feat: interactive auth method selection with API token validation

- Add GetToken() as unified auth entry point with method selection
- Prompt [1] OAuth / [2] API token on first launch, save choice
- Validate API tokens against /api/v1/users/self before saving
- Check saved API token validity on reuse; fallback to re-prompt on failure
- Add HTTP status check to GetCourseInfo and GetEnrolledCourses
- Remove --api flag, auth method is now persistent and interactive

README.md

@@ -31,15 +31,11 @@ go build -o canvasarchiver ./cmd/canvasarchiver
     ./canvasarchiver -vo
     ```
 
-   Or to use a manually generated Canvas API token:
-   ```bash
-   ./canvasarchiver --api
-   ```
+2. On first run, you'll be prompted to choose an authentication method:
+   - **[1] Login via browser (OAuth)**: Visit the provided URL, authorize, and paste the code
+   - **[2] Use Canvas API token**: Enter a manually generated API token (e.g. `12230~...`)
 
-2. On first run, you'll be prompted to authenticate:
-   - Visit the provided OAuth URL
-   - Authorize the application
-   - Copy the authorization code back to the terminal
+   The choice is saved and reused on subsequent runs.
 
 3. Enter your Course ID when prompted (or use `-me` to download all enrolled courses)
 
@@ -58,8 +54,6 @@ go build -o canvasarchiver ./cmd/canvasarchiver
 | `-vo` | Videos only — scan recordings and all module video items, download everything flat into one directory; skips regular files |
 | `-me` | Download all enrolled courses |
 | `-n` | Prefix modules with order numbers `[1]`, `[2]`, etc. |
-| `--api` | Use a manually generated Canvas API token instead of OAuth |
-
 
 ## Configuration
 
@@ -72,9 +66,7 @@ The following constants can be modified in `internal/config/config.go`:
 
 ## Authentication
 
-Credentials are stored in `credentials.json` after the first successful login. The refresh token is automatically used for subsequent runs.
-
-With `--api`, enter a manually generated Canvas API token on first use. It is saved to `credentials.json` and reused on later `--api` runs.
+Credentials are stored in `credentials.json` after the first successful authentication. The chosen method is remembered for subsequent runs — OAuth refresh tokens are automatically refreshed, and API tokens are validated before saving.
 
 ## Notes