Add databricks auth switch command for setting the default profile (#4651)

## Why

There is no way to set which profile is the active default without
renaming it to `[DEFAULT]`. Users with multiple profiles need a simple
way to switch between them.

## Changes

Before: no mechanism to designate a default profile. Users had to rename
sections in `~/.databrickscfg` or always pass `--profile`.

Now: `databricks auth switch` lets users select a named profile as the
default. The choice is stored in a `[__settings__]` section with a
`default_profile` key. `auth profiles` shows a `(Default)` marker, and
`auth describe` shows the resolved default name.

### Why `[__settings__]` instead of a top-level key?

INI files place keys that appear before any section header into the
`[DEFAULT]` section. The CLI already uses `[DEFAULT]` as a regular
profile section (with `host`, `token`, etc.), so adding
`default_profile` there would mix settings with profile credentials, and
the profiles command would try to interpret `[DEFAULT]` as a profile
containing that key. A dedicated `[__settings__]` section avoids this
collision and is silently ignored by older SDKs (no `host` key means it
is skipped in profile iteration).

### Implementation

- **`libs/databrickscfg/ops.go`**:
`GetDefaultProfile`/`GetDefaultProfileFrom` with fallback resolution
(explicit setting, single-profile auto-default, legacy DEFAULT section).
`SetDefaultProfile` to write the setting. Shared
`backupAndSaveConfigFile` and `resolveConfigFilePath` helpers to
deduplicate existing code.
- **`cmd/auth/switch.go`**: new command with `--profile` flag
(non-interactive) and interactive profile picker showing the current
default.
- **`cmd/auth/profiles.go`**: `(Default)` marker in output and `default`
field in JSON.
- **`cmd/auth/describe.go`**: shows resolved default profile name, e.g.
`profile: default (my-workspace)`.
- **`cmd/auth/login.go` + `token.go`**: auto-set default when creating
the very first profile.

Resolution wiring (making the CLI actually use `default_profile` when no
`--profile` is given) is out of scope. That will be a follow-up change
touching `cmd/root/auth.go` and the bundle config path.

## Test plan

- [x] Unit tests for `GetDefaultProfile`, `GetDefaultProfileFrom`,
`SetDefaultProfile` (table-driven, covering: explicit setting,
single-profile fallback, DEFAULT fallback, no file, round-trip with
`SaveToProfile`)
- [x] Unit tests for `auth switch` command (with `--profile`, profile
not found, non-interactive error, settings section written correctly)
- [x] Unit tests for `hasNoProfiles` (fresh machine /
ErrNoConfiguration, empty file, existing profiles)
- [x] Unit test for `(Default)` marker in `auth profiles`
- [x] `GetDefaultProfile` does not create the config file as a side
effect (asserted in test)
- [x] `make checks` and `make lintfull` pass
- [x] Manual: `databricks auth switch --profile <name>`, verify
`~/.databrickscfg` has `[__settings__]` section
- [x] Manual: `databricks auth profiles` shows `(Default)` marker
- [x] Manual: `databricks auth switch` interactive picker shows current
default

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: simonfaltum

acceptance/cmd/auth/describe/default-profile/out.test.toml

@@ -0,0 +1,15 @@
+
+=== Describe without --profile (should use default)
+
+>>> [CLI] auth describe
+Host: [DATABRICKS_URL]
+User: [USERNAME]
+Authenticated with: pat
+-----
+Current configuration:
+  ✓ host: [DATABRICKS_URL] (from DATABRICKS_HOST environment variable)
+  ✓ token: ******** (from DATABRICKS_TOKEN environment variable)
+  ✓ profile: my-workspace
+  ✓ databricks_cli_path: [CLI]
+  ✓ auth_type: pat
+  ✓ rate_limit: [NUMID] (from DATABRICKS_RATE_LIMIT environment variable)

acceptance/cmd/auth/describe/default-profile/output.txt

@@ -0,0 +1,20 @@
+sethome "./home"
+
+# Create a config with two profiles and an explicit default.
+cat > "./home/.databrickscfg" <<EOF
+[DEFAULT]
+
+[my-workspace]
+host  = $DATABRICKS_HOST
+token = $DATABRICKS_TOKEN
+
+[other-workspace]
+host  = https://other.cloud.databricks.com
+token = other-token
+
+[__settings__]
+default_profile = my-workspace
+EOF
+
+title "Describe without --profile (should use default)\n"
+trace $CLI auth describe

acceptance/cmd/auth/describe/default-profile/script

@@ -0,0 +1,3 @@
+Ignore = [
+    "home"
+]

acceptance/cmd/auth/describe/default-profile/test.toml

@@ -4,3 +4,6 @@
 [test]
 host      = [DATABRICKS_URL]
 auth_type = databricks-cli
+
+[__settings__]
+default_profile = test

acceptance/cmd/auth/login/nominal/out.databrickscfg

@@ -3,5 +3,5 @@
 Profile test was successfully saved
 
 >>> [CLI] auth profiles
-Name  Host                    Valid
-test  [DATABRICKS_URL]  YES
+Name            Host                    Valid
+test (Default)  [DATABRICKS_URL]  YES

acceptance/cmd/auth/login/nominal/output.txt

@@ -5,3 +5,6 @@
 host      = [DATABRICKS_URL]
 scopes    = jobs,pipelines,clusters
 auth_type = databricks-cli
+
+[__settings__]
+default_profile = scoped-test

acceptance/cmd/auth/login/with-scopes/out.databrickscfg

@@ -0,0 +1,4 @@
+; The profile defined in the DEFAULT section is to be used as a fallback when no profile is explicitly specified.
+[DEFAULT]
+
+[__settings__]

acceptance/cmd/auth/logout/delete-clears-default/out.databrickscfg

@@ -0,0 +1,18 @@
+
+=== Initial settings section
+[__settings__]
+default_profile = workspace-a
+
+=== Delete the default profile
+>>> [CLI] auth logout --profile workspace-a --force --delete
+Deleted profile "workspace-a" with no tokens to clear.
+
+=== Settings after deleting default — default_profile should be cleared
+[__settings__]
+
+=== Delete a non-default profile
+>>> [CLI] auth logout --profile workspace-b --force --delete
+Deleted profile "workspace-b" with no tokens to clear.
+
+=== Settings after deleting non-default — section should still be present but empty
+[__settings__]