feat(cli): add reusable cli package

- Extract CLI commands into cli/ package with injected Store interface
- cmd/mbz/main.go is now a thin wrapper over cli.NewCommand()
- Split single auth.json into separate credentials.json + token.json
- Document CLI architecture and dual auth model in AGENTS.md
- Migrate to charm.land/fang/v2 v2.0.1 and charm.land/lipgloss/v2 v2.0.2

Author: odsod

AGENTS.md

@@ -1,16 +1,51 @@
 # Agent Instructions
 
 ## Package Manager
+
 Use **Go Modules**: `go mod tidy`, `go test ./...`
 Use **Mage**: `go tool mage [target]` (e.g. `go tool mage Build`)
 
 ## Key Conventions
+
 - **Testing**: Use standard `testing` and `github.com/google/go-cmp/cmp` **only**. No frameworks (Testify, Ginkgo, etc.).
 - **Linting**: Run `GolangCI-Lint` v2. Configure via project-specific `.golangci.yml`.
 - **Build**: Use `way-magefile` skill.
 - **Encore**: Use `encore-go-*` skills. Encore conventions (e.g., globals) take precedence.
 
 ## Local Skills
+
 - **Way Go Style**: Use `.agents/skills/way-go-style/SKILL.md`
 - **Way Magefile**: Use `.agents/skills/way-magefile/SKILL.md`
 - **Agents.md**: Use `.agents/skills/agents-md/SKILL.md`
+
+## CLI Architecture
+
+The CLI is split into two layers to keep credential storage pluggable:
+
+```
+cli/
+├── cli.go       # Store interface, Credentials, FileStore, Options
+└── command.go   # NewCommand() — full command tree
+cmd/mbz/
+└── main.go      # Thin wrapper: wires FileStore to XDG paths
+```
+
+- `cli.Store` — interface with `Read(any)`, `Write(any)`, `Clear()` methods
+- `cli.NewCommand(...Option)` — builds the Cobra command tree; receives stores via functional options (`WithCredentialStore`, `WithTokenStore`)
+- `cmd/mbz/main.go` — only wires `FileStore` instances and calls `cli.NewCommand()`
+
+This separation lets consumers embed the CLI in a larger tool or swap the storage backend (e.g. use an in-memory store in tests, or a keychain-backed store) without forking.
+
+### Dual Authentication
+
+The Mercedes-Benz API uses two auth methods depending on the endpoint:
+
+- **OAuth2 client credentials** — for vehicle management, data services, delta push
+- **API key** — for vehicle specification and images
+
+Both are stored in the credential store. The OAuth2 token is cached separately in the token store.
+
+### Conventions
+
+- Subcommands are organized by entity using `cobra.Group`
+- Flat command structure: `vehicles`, `services`, not `vehicles list`

cli/cli.go

@@ -0,0 +1,84 @@
+package cli
+
+import (
+	"encoding/json"
+	"fmt"
+	"os"
+	"path/filepath"
+)
+
+// Store reads and writes JSON-serializable data.
+type Store interface {
+	Read(target any) error
+	Write(data any) error
+	Clear() error
+}
+
+// Credentials for Mercedes-Benz API authentication.
+type Credentials struct {
+	Region       string `json:"region"`
+	ClientID     string `json:"clientId,omitempty"`
+	ClientSecret string `json:"clientSecret,omitempty"`
+	APIKey       string `json:"apiKey,omitempty"`
+}
+
+// Option configures the CLI command tree.
+type Option func(*config)
+
+type config struct {
+	credentialStore Store
+	tokenStore      Store
+}
+
+// WithCredentialStore sets the credential store.
+func WithCredentialStore(s Store) Option {
+	return func(c *config) { c.credentialStore = s }
+}
+
+// WithTokenStore sets the token store.
+func WithTokenStore(s Store) Option {
+	return func(c *config) { c.tokenStore = s }
+}
+
+// FileStore is a JSON file-backed store.
+type FileStore struct {
+	path string
+}
+
+// NewFileStore creates a new file-backed store at the given path.
+func NewFileStore(path string) *FileStore {
+	return &FileStore{path: path}
+}
+
+// Read unmarshals the file contents into target.
+func (s *FileStore) Read(target any) error {
+	data, err := os.ReadFile(s.path)
+	if err != nil {
+		return fmt.Errorf("read store: %w", err)
+	}
+	if err := json.Unmarshal(data, target); err != nil {
+		return fmt.Errorf("unmarshal store: %w", err)
+	}
+	return nil
+}
+
+// Write marshals data and writes it to the file.
+func (s *FileStore) Write(data any) error {
+	bytes, err := json.MarshalIndent(data, "", "  ")
+	if err != nil {
+		return fmt.Errorf("marshal store: %w", err)
+	}
+	if err := os.MkdirAll(filepath.Dir(s.path), 0o700); err != nil {
+		return fmt.Errorf("create store dir: %w", err)
+	}
+	return os.WriteFile(s.path, bytes, 0o600)
+}
+
+// Clear removes the file.
+func (s *FileStore) Clear() error {
+	err := os.Remove(s.path)
+	if err != nil && os.IsNotExist(err) {
+		return nil
+	}
+	return err
+}