fix(auth): print only a token that belongs to the selected account

Signed-off-by: bircni <bircni@icloud.com>

internal/app/auth.go

@@ -801,6 +801,16 @@ $ tea auth token --host gitea.com --user alice`,
 			if instance, err := settings.ResolveHost(a.tokenInstance(), s.Hosts.Hosts); err != nil || instance != t.Host {
 				token = ""
 			}
+			if token != "" && t.User != "" {
+				// Like connect, print the environment token only for the account it authenticates.
+				actual, err := services.CurrentAccount(cmd.Context(), a.deps.Client(t.Host, token, t.host.Insecure))
+				if err != nil {
+					return err
+				}
+				if !services.MatchAccount(t.User, actual) {
+					return clierr.Wrap(clierr.Authentication, errEnvironmentAccount)
+				}
+			}
 			if token == "" {
 				account, exists := t.host.Users[t.User]
 				switch {