[Maintenance] Add auth status, logout, DWD subject, and compatibility tests

[terrancedejesus]

Summary

• Keep the existing swat CLI, auth session / auth list, creds, store keys (default / external), pickle store, and emulation session_key arguments unchanged for forks and current operators.
• Add auth status and auth logout (local session clear only) plus optional auth session --service-account --subject USER@DOMAIN for domain-wide delegation.
• Lock the public command, emulation, config, and import surface with mocked tests. No live tenant or real credentials.

Test plan

• poetry run pytest tests/ -v passes locally (70 tests)
• Existing auth session / auth list / creds add|remove|list invocations still work
• auth status does not print client secrets or private keys
• auth logout default clears the session and leaves the stored credential
• auth session --subject without --service-account is rejected
• CI pytest job passes