Authorization refactoring

[l2ysho]

description TBD

Device flow

API part is implemented in https://github.com/apify/apify-core/pull/27640. We have a multiple issue more or less connected to this. Main part should be implemented in #1329 and should directly close #1106 (safari no longer a problem with device flow). Also #1266 look doable as part of device flow.

Related bugs

These bugs should be fixed directly by device flow, if needed, lets create a sub issue => #1327 #1053 #611 (probably duplicate of the same problem), but this needs to be verified

Token handling

There is multiple token related issue which should be handled (in followup issue if needed), there are two related to APIFY_TOKEN env variable. I started with fixing APIFY_TOKEN precedence #1293(this may not be good idea at all) but there is also #720 so it looks like this was problem even before keychain changes. I am leaning to not use APIFY_TOKEN (as it is used on 3 places) and use only --token (or the opposite, but support only one of them), but open to discuss. Also #1262 related to this. Also apify/agent-skills#80 suggests to remove APIFY_TOKEN. As I mentioned in #1293 resolveToken really needs some love.

Some secondary issues which are worth to fix

• Figure out a better auth file structure for future extensibility #567 should be done as a part of multi-account approach, not as a part of this epic ( I will create a separate one for multi-account / org )
• Improve support for scoped tokens #780 -> scoped token implementation, this need to be discussed
• actors search fails with 401 when user has expired/invalid token #1051 -> properly handle 401 errors,, this should be fixed in device flow

@DaveHanns @vladfrangu @patrikbraborec feel free to edit