refactor: centralize authorized_keys content generation to simplify future extensions

Author: ToeiRei

internal/config/config.go

@@ -161,7 +161,9 @@ func LoadConfig[T any](cmd *cobra.Command, defaults map[string]any, additional_c
 	viper.SetEnvKeyReplacer(strings.NewReplacer(".", "_"))
 
 	// cli
-	// TODO maybe needs to trigger additional parsing beferohand (most likely nots)
+	// TODO: consider whether flag/env parsing should run earlier for special
+	// cases (e.g., test harnesses or explicit pre-processing). Current flow
+	// binds CLI flags here and then unmarshals into the config object.
 	if err := viper.BindPFlags(cmd.Flags()); err != nil {
 		return c, err
 	}

internal/uiadapters/store.go

@@ -168,9 +168,18 @@ func (s *storeAdapter) GenerateAuthorizedKeysContent(ctx context.Context, accoun
 	if err != nil {
 		return "", err
 	}
-	// TODO: Consider centralizing BuildAuthorizedKeysContent variants
-	// (e.g., adding signing headers) behind a stable facade if further
-	// customization is required by different UI surfaces.
+	// Centralize call via a single unexported helper to make it easier to
+	// extend or variant-implement the authorized_keys generation in one
+	// place without duplicating call sites. This is a mechanical consolidation
+	// only and does not change behavior.
+	return s.buildAuthorizedKeysContent(sk, gks, aks)
+}
+
+// buildAuthorizedKeysContent centralizes the call to `keys.BuildAuthorizedKeysContent`.
+// Keep this unexported wrapper to provide a single place to add future
+// variants (headers, signing metadata) without changing the higher-level
+// control flow in `GenerateAuthorizedKeysContent`.
+func (s *storeAdapter) buildAuthorizedKeysContent(sk *model.SystemKey, gks, aks []model.PublicKey) (string, error) {
 	return keys.BuildAuthorizedKeysContent(sk, gks, aks)
 }