refactor: simplify CLI workflows and strengthen end-to-end coverage

[theg1239]

Summary

• preserve the animated command shimmer, including its TTY redraw and clean stop lifecycle
• remove dead helpers, duplicate request paths, stale flags, commented implementations, and redundant clients
• fix semester selection across attendance, marks, grades, and exams
• harden encrypted credential storage, login retries, session refresh, proxy isolation, TLS verification, CAPTCHA fallback, and logout
• pin executable updates to the official metadata endpoint and simplify kill-switch/update fetching
• improve facility, nightslip, leave, course allocation, course-page, syllabus, DA, timetable, and exam workflows
• centralize cross-package workflow and executable coverage under tests/
• tighten CI, dependency hygiene, package metadata, and command/helper documentation

Why

The CLI had accumulated duplicated HTTP paths, unused state and flags, stale documentation, and several error paths that only behaved correctly in debug mode. Session refresh could also retry with invalid credentials, fan out concurrent logins, or use the local account during proxy sync.

This change reduces those moving parts while preserving the existing command surface and shimmer UX.

User impact

• positive --semester selections are now honored consistently
• credentials remain encrypted locally and the config is written with restrictive permissions
• expired sessions refresh once and safely share the refreshed session across concurrent requests
• proxy sync refreshes with the credentials supplied to the proxy command
• manual CAPTCHA input no longer collides with the shimmer redraw
• updater downloads cannot be redirected by the test metadata override
• command aliases, flags, help text, and reference documentation match the implementation

Validation

• go test ./...
• go test -race -shuffle=on -count=3 ./...
• go vet ./...
• go mod tidy -diff
• full gofmt and git diff --check
• feature workflow E2Es repeated 30 times
• executable CLI E2Es repeated 10 times
• shimmer lifecycle tests repeated 50 times
• Linux amd64/arm64, macOS amd64/arm64, and Windows amd64 cross-builds
• live smoke testing for non-mutating VTOP commands; state-changing submissions were exercised against stateful mocks

spent a lot of water and tokens to review your slop

Greptile Summary

This PR simplifies CLI workflows and expands end-to-end coverage. The main changes are:

• Centralized session refresh, proxy login, and HTTP handling.
• Consistent semester selection across academic commands.
• Stronger credential storage and logout error handling.
• Validated update metadata and fail-closed facility controls.
• Broader workflow, executable, concurrency, and cross-platform tests.
• Updated command flags, aliases, CI checks, and documentation.

Confidence Score: 5/5

This looks safe to merge.

The credential permission failure is now reported, unavailable or malformed kill-switch metadata blocks facility registration, and tests cover the updated failure paths.

T-Rex Logs

What T-Rex did

• Reviewed the cli-go-race-shuffle-02-after.log to confirm the command, working directory, UTC timing, exit status, and complete stdout and stderr.
• Verified the cli-go-race-shuffle-runner.sh contains the exact generated runner used in this test.
• Checked the cli-go-race-shuffle-manifest.log to confirm HEAD, Go version, SHA-256 checksums, and package-level results for this run.

_{Ran code and verified through T-Rex}

Important Files Changed

Filename	Overview
cmd/creds.go	Adds validated credential input, encryption error handling, and restrictive config permissions.
helpers/check-cli-top.go	Centralizes metadata validation and defaults failed kill-switch checks to facility view-only mode.
features/facility.go	Keeps facility listings available while blocking registration when metadata checks fail.

_{Reviews (2): Last reviewed commit: "fix: preserve course-allocation session ..." | Re-trigger Greptile}

[gitguardian]

⚠️ GitGuardian has uncovered 1 secret following the scan of your pull request.

Please consider investigating the findings and remediating the incidents. Failure to do so may lead to compromising the associated services or software components.

🔎 Detected hardcoded secret in your pull request

GitGuardian id	GitGuardian status	Secret	Commit	Filename
34751097	Triggered	Generic Password	656abf7	cmd/encrypt_test.go	View secret

🛠 Guidelines to remediate hardcoded secrets

1. Understand the implications of revoking this secret by investigating where it is used in your code.
2. Replace and store your secret safely. Learn here the best practices.
3. Revoke and rotate this secret.
4. If possible, rewrite git history. Rewriting git history is not a trivial act. You might completely break other contributing developers' workflow and you risk accidentally deleting legitimate data.

To avoid such incidents in the future consider

• following these best practices for managing and storing secrets including API keys and other credentials
• install secret detection on pre-commit to catch secret before it leaves your machine and ease remediation.

---

^{🦉 GitGuardian detects secrets in your source code to help developers and security teams secure the modern development process. You are seeing this because you or someone else with access to this repository has authorized GitGuardian to scan your pull request.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 04bbaa2d1c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".