fix: auth-decisions (follow gh: auth status exit code and GITEA_TOKEN account)

Signed-off-by: bircni <bircni@icloud.com>

internal/app/target.go

@@ -186,8 +186,10 @@ func (a *application) connect(ctx context.Context, req targetRequest) (target, e
 		if err != nil {
 			return t, err
 		}
-		// The message must not reveal which account the token belongs to.
-		if !services.MatchAccount(t.User, actual) {
+		// Like GH_TOKEN, the token overrides the stored credentials whichever account is active;
+		// only an account that --user or TEA_USER names must match. The message must not reveal
+		// which account the token belongs to.
+		if t.explicitUser() && !services.MatchAccount(t.User, actual) {
 			return t, clierr.Wrap(clierr.Authentication, errEnvironmentAccount)
 		}
 		if t.User == "" {
@@ -425,6 +427,11 @@ func (a *application) selectAccount(ctx context.Context, t *target, s settings.S
 	return nil
 }
 
+// explicitUser reports whether the user named the account with --user or TEA_USER.
+func (t target) explicitUser() bool {
+	return t.User != "" && (t.UserSource == "--user" || t.UserSource == "TEA_USER")
+}
+
 // accountError explains why user has no stored credential on the target's instance.
 func (t target) accountError(user string) error {
 	users := t.host.Users