feat(credentials): let users choose the account for interactive login (DM-3512)

[yangru96]

Description

OAuthInteractive silently used the first account it found in the token cache, so users signed in with several accounts had no way to choose and often ended up on the wrong one.

Add prompt and login_hint to OAuthInteractive, its default_for_entra_id helper, (Async)CogniteClient.default_oauth_interactive and the YAML/JSON config accepted by load(). Pass prompt="select_account" to pick the account in the browser, or login_hint to name it up front and skip being asked. Once signed in, later token refreshes stay on that account without prompting again.

Behavior change: when the token cache holds several accounts and neither argument is given, the browser now opens with an account picker instead of silently using an arbitrary account. A single cached account is still reused silently, so users with one account are unaffected.

Checklist:

• [x Tests added/updated.
• Documentation updated. Documentation is generated from docstrings - these must be updated according to your change. If a new method has been added it should be referenced in cognite.rst in order to generate docs based on its docstring.
• The PR title follows the Conventional Commit spec.

[gemini-code-assist]

Code Review

This pull request adds support for prompt and login_hint parameters to the interactive OAuth flow in OAuthInteractive and default_oauth_interactive across sync and async clients, enabling explicit account selection and login hints. Feedback was provided to use credentials.get("id_token_claims") or {} to defensively handle cases where the claims key exists but is None.

[haakonvt]

A few late night comments from me, overall looks solid. I will attempt to test it out in the morning and connect you with the guy that reported this initially, cc @spex66

[codecov]

Codecov Report

❌ Patch coverage is 98.57143% with 2 lines in your changes missing coverage. Please review.
✅ Project coverage is 93.77%. Comparing base (b90a384) to head (049484a).
⚠️ Report is 1 commits behind head on master.

Files with missing lines	Patch %	Lines
cognite/client/_cognite_client.py	50.00%	1 Missing ⚠️
cognite/client/_sync_cognite_client.py	50.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #2730      +/-   ##
==========================================
- Coverage   93.77%   93.77%   -0.01%     
==========================================
  Files         513      513              
  Lines       52490    52620     +130     
==========================================
+ Hits        49224    49345     +121     
- Misses       3266     3275       +9     

Files with missing lines	Coverage Δ
cognite/client/credentials.py	87.31% <100.00%> (+1.82%)	⬆️
tests/tests_unit/test_credential_providers.py	100.00% <100.00%> (ø)
cognite/client/_cognite_client.py	95.83% <50.00%> (ø)
cognite/client/_sync_cognite_client.py	88.88% <50.00%> (ø)

... and 7 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[haakonvt]

Great job with this! One comment re. docs otherwise LGTM

[andreavs]

🦄