feat: Add automatic credential renewal with intelligent scheduling

[inderpartap]

Summary

Implements automatic renewal of AWS credentials before expiration, eliminating manual re-authentication throughout the workday.

Key Features

• Background daemon monitors specified profiles and auto-renews before expiration
• Intelligent scheduling: sleeps until renewal needed (no constant polling)
• Batch renewal: multiple profiles renewed with single Okta authentication using --multi-profiles
• Config responsiveness: max_sleep_minutes ensures config changes picked up promptly
• macOS launchd integration: service survives system sleep/wake
• Device token support: passwordless renewal after initial authentication
• Expiration tracking: stores credential expiration in ~/.aws/credentials

New CLI Commands

# Enable auto-renewal
tokendito --auto-renew-enable \
    --auto-renew-profiles default \
    --auto-renew-profiles cicd_prod

# Check status
tokendito --auto-renew-status

# Disable
tokendito --auto-renew-disable

# Manual daemon
tokendito-renew-daemon [--check-once]

Configuration

Settings stored in tokendito.ini:

[auto-renewal]
enabled = true
profiles = profile1, profile2
renewal_threshold_minutes = 30
check_interval_minutes = 10
max_sleep_minutes = 60

Technical Details

Intelligent Scheduling

• Daemon calculates when credentials expire
• Sleeps until renewal time (not polling at intervals)
• Example: 12-hour credentials → wakes up every 60 min to check config, renews at 11.5 hour mark
• Max sleep cap ensures config changes picked up within 60 minutes

Batch Renewal Efficiency

• Uses tokendito --multi-profiles profile1 --multi-profiles profile2 ...
• Single Okta authentication for all profiles needing renewal
• Much more efficient than individual renewals

Platform Support

• macOS: Full support with automatic launchd service
• Linux/Windows: Manual daemon execution (systemd/Task Scheduler recommended)

Test Coverage

• 29 unit tests (100% passing)
• Comprehensive coverage of renewal logic, scheduling, and daemon operations
• Mock-based tests (no external dependencies)

Documentation

• docs/AUTO_RENEWAL.md: Complete user guide
• Multiple technical guides and quick start documentation
• Updated main README with auto-renewal section

Test Plan

• Unit tests pass
• Manual testing on macOS with 6 profiles
• Verified launchd service starts and runs
• Confirmed batch renewal with --multi-profiles
• Validated intelligent scheduling calculations
• Tested config change detection (max_sleep_minutes)
• Verified expiration tracking in credentials file
• Integration testing with real credentials
• Long-term stability testing (24+ hours)

Breaking Changes

None. This is a new feature with no impact on existing functionality.

Related Issues

Implements credential auto-renewal functionality requested for continuous development workflows.

---

🤖 Generated with Claude Code

[inderpartap]

To be removed.
Consider this as an in-depth explanation of the feature set while the PR is in-review. We'll clean up the docs when it's ready to be merged

[memo-moreno]

Works for me