feat: add --api flag for Canvas API token authentication

- Add APIToken field to Credentials struct with omitempty JSON tag
- Implement GetAPIToken() method with persistent token storage
- Add SaveRefreshToken() helper to preserve API tokens during OAuth
- Implement --api CLI flag to use API token instead of OAuth
- Validate empty refresh tokens and skip refresh if invalid
- Update README with API token usage documentation

internal/auth/auth.go

@@ -32,6 +32,9 @@ func (a *Authenticator) GetAccessToken() (string, error) {
 	if err != nil {
 		return a.login()
 	}
+	if strings.TrimSpace(creds.RefreshToken) == "" {
+		return a.login()
+	}
 
 	fmt.Println("[*] Reusing saved refresh token...")
 	tr, err := a.doTokenRequest(url.Values{
@@ -49,6 +52,36 @@ func (a *Authenticator) GetAccessToken() (string, error) {
 	return tr.AccessToken, nil
 }
 
+func (a *Authenticator) GetAPIToken() (string, error) {
+	creds, err := LoadCredentials()
+	if err == nil && strings.TrimSpace(creds.APIToken) != "" {
+		fmt.Println("[*] Reusing saved API token...")
+		return strings.TrimSpace(creds.APIToken), nil
+	}
+	if err != nil {
+		creds = &models.Credentials{}
+	}
+
+	fmt.Print("Enter Canvas API token: ")
+	token, err := bufio.NewReader(os.Stdin).ReadString('\n')
+	if err != nil && err != io.EOF {
+		return "", err
+	}
+
+	token = strings.TrimSpace(token)
+	if token == "" {
+		return "", fmt.Errorf("empty API token")
+	}
+
+	creds.APIToken = token
+	if err := SaveCredentials(creds); err != nil {
+		return "", err
+	}
+
+	fmt.Println("[+] API token saved.")
+	return token, nil
+}
+
 func (a *Authenticator) login() (string, error) {
 	codeVerifier, codeChallenge, err := generatePKCEPair()
 	if err != nil {
@@ -80,7 +113,9 @@ func (a *Authenticator) login() (string, error) {
 		return "", err
 	}
 
-	SaveCredentials(&models.Credentials{RefreshToken: tr.RefreshToken})
+	if err := SaveRefreshToken(tr.RefreshToken); err != nil {
+		return "", err
+	}
 	fmt.Println("[+] Login successful.")
 	return tr.AccessToken, nil
 }
@@ -162,9 +197,21 @@ func extractCode(input string) (string, error) {
 	return input, nil
 }
 
-func SaveCredentials(creds *models.Credentials) {
-	data, _ := json.MarshalIndent(creds, "", "  ")
-	os.WriteFile(config.CredsFile, data, 0o644)
+func SaveCredentials(creds *models.Credentials) error {
+	data, err := json.MarshalIndent(creds, "", "  ")
+	if err != nil {
+		return err
+	}
+	return os.WriteFile(config.CredsFile, data, 0o644)
+}
+
+func SaveRefreshToken(refreshToken string) error {
+	creds, err := LoadCredentials()
+	if err != nil {
+		creds = &models.Credentials{}
+	}
+	creds.RefreshToken = refreshToken
+	return SaveCredentials(creds)
 }
 
 func LoadCredentials() (*models.Credentials, error) {
@@ -173,6 +220,8 @@ func LoadCredentials() (*models.Credentials, error) {
 		return nil, err
 	}
 	var creds models.Credentials
-	json.Unmarshal(data, &creds)
+	if err := json.Unmarshal(data, &creds); err != nil {
+		return nil, err
+	}
 	return &creds, nil
 }