fix: auth-decisions (follow gh: auth status exit code and GITEA_TOKEN account)

Signed-off-by: bircni <bircni@icloud.com>

internal/app/auth.go

@@ -107,7 +107,8 @@ func (a *application) authCommand() *cobra.Command {
 tea keeps the accounts of each instance in hosts.yml and their tokens in the system
 keyring, or in a private file when you choose so. One account per instance is active;
 --user or TEA_USER selects another for a single command. GITEA_TOKEN, together with
-GITEA_INSTANCE_URL or TEA_HOST, replaces the stored credentials of its instance. See
+GITEA_INSTANCE_URL or TEA_HOST, replaces the stored credentials of its instance for the
+active account too; it must belong to the account that --user or TEA_USER names. See
 tea help environment for how commands select the instance.`}
 	group.AddCommand(a.loginCommand(), a.logoutCommand(), a.authStatusCommand(), a.authSwitchCommand(), a.authRefreshCommand(), a.authTokenCommand(), a.setupGitCommand(), a.gitCredentialCommand())
 	return group
@@ -424,7 +425,7 @@ func (a *application) authStatusCommand() *cobra.Command {
 		Use: "status", Short: "Show the accounts tea can use", Args: argsExact(0),
 		Long: `Show the accounts tea can use on each instance, the active one, and how they
 authenticate. Fails with exit code 4 when there is no account, or when a credential is
-missing or rejected.`,
+missing or rejected. With --json it exits 0 either way; read credential_available, verified and error.`,
 		Example: `$ tea auth status
 # Check the credentials against their instances
 $ tea auth status --verify
@@ -836,8 +837,8 @@ $ tea auth token --host gitea.com --user alice`,
 			if instance, err := settings.ResolveHost(a.tokenInstance(), s.Hosts.Hosts); err != nil || instance != t.Host {
 				token = ""
 			}
-			if token != "" && t.User != "" {
-				// Like connect, print the environment token only for the account it authenticates.
+			if token != "" && t.explicitUser() {
+				// Like connect, print the environment token only for the account --user or TEA_USER names.
 				actual, err := services.CurrentAccount(cmd.Context(), a.deps.Client(t.Host, token, t.host.Insecure))
 				if err != nil {
 					return err