feat: add native connections command

[developerkunal]

🔧 Changes

Adds a first-class auth0 connections command tree so connections can be managed natively instead of through auth0 api.

New commands:

• auth0 connections list — list connections, with --query for JSON-based filtering and --schema to see available query parameters.
• auth0 connections create — create a connection interactively (name prompt + strategy picker) or non-interactively via --name/--strategy or --data.
• auth0 connections show <id> — show a connection's full, strategy-specific configuration.
• auth0 connections update <id> — update via --data, or interactively through an editor pre-filled with the current mutable configuration.
• auth0 connections delete <id...> — delete one or more connections, with confirmation and --force.
• auth0 connections enabled-clients show <id> — list the applications that have the connection enabled.
• auth0 connections enabled-clients update <id> — update enabled clients via --data (with --schema to print the expected payload), or interactively through an application multi-select pre-populated with the currently-enabled clients (only the diff is sent).

Implementation notes:

• Reads (list, enabled-clients) use the go-auth0 v3 SDK with checkpoint pagination. --data create and update go through the schema-validated raw HTTP path so strategy-specific options are preserved without loss from typed models.
• The flag-based create (--name/--strategy) sends its trivially-valid body straight to the raw HTTP path without loading the OpenAPI schema, so interactive and flag-based creation still work when the schema cannot be fetched (for example, a fresh machine that is offline).
• --data accepts inline JSON, @file, or piped stdin, validated against the OpenAPI schema before the request. When an operation has no local schema, the payload is sent unvalidated and a diagnostic says so, matching the other --data commands.
• On an API error, create and update append the expected request schema to the human-readable message; in JSON/agent error mode the raw API error is returned unchanged so the error envelope stays clean.
• list --query uses the shared query flag and encoder, so a JSON array value expands into repeated query parameters ({"strategy":["auth0","oidc"]} sends strategy=auth0&strategy=oidc), numbers keep their literal, a null is omitted, and a nested object is rejected as a validation error.
• Interactive update strips the immutable fields (id, name, strategy) from the editor, since the PATCH /connections/{id} schema does not accept them (display_name remains editable).
• Added the missing create:connections and delete:connections scopes to the login authorization request.

📚 References

N/A

🔬 Testing

• Added table-driven unit tests for checkpoint pagination (TestCollectConnections), the connection strategy picker (TestConnectionPickerOptions), and immutable-field stripping on interactive update (TestStripConnectionImmutableFields).
• Added connections_json_test.go covering the JSON write path: list --query with invalid JSON errors before any API call, create --data sends a validated payload to POST /connections and rejects a schema-invalid payload without reaching the API, and update --data sends to PATCH /connections/{id}.
• Added a commander integration suite (test/integration/connections-test-cases.yaml, 17 cases) covering list, create (flags, JSON, and invalid JSON), query filtering, the create and enabled-clients update schemas, show, update, enabled-clients, the interactive-update guard, agent-mode delete refusal, and delete, plus cleanup wiring in test-cleanup.sh.
• Regenerated command docs with make docs; make test-unit, go vet, and golangci-lint are clean.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)