fix(cli/push): address round-2 Bugbot findings on the v0.4.0 RC (#106)

[saadqbal]

Second batch of Cursor Bugbot findings on the v0.4.0 RC — surfaced when Bugbot re-reviewed the promote PR #107 after #108 merged. Both Medium. Rolls up under #106.

1. cli: logout left active_client_id behind (Medium)

logout cleared the token + email but not active_client_id. That pointer is account-scoped, so a later login as a different user inherited the stale id — auth status / client list would show the previous account's active client until overwritten. Now cleared alongside the token/email.

2. push: schema accepts token_classification, registry didn't know it (Medium)

The re-vendored ingest.v1.json (#103) added token_classification, but categoryRegistry didn't — so dataset push --category=token_classification hit the "unrecognized category" path despite passing schema validation (same class as the causal_language_modeling fix in #108). Added it as a known, not-yet-supported FamilyText category with a pending-support note — the safe default (it was never pushable, so this only improves the message).

Root-cause guard (stops the whack-a-mole): the registry tests only pinned the registry against a hand-written list, which stayed self-consistent while drifting from the schema. Added TestRegistryCoversSchemaCategories — it parses the embedded schema's category enum and asserts every entry is registry-known, so any future schema-only category is caught here instead of in a later review pass. (The reverse — a registry-only known-unsupported alias like instance_segmentation — is allowed; it's gated out before schema validation.)

Tests

• logout now asserts active_client_id is cleared
• new schema⇄registry parity test (would fail on the pre-fix registry)
• gofmt/vet/build clean; full go test -race -cover ./... green

🤖 Generated with Claude Code

---

Note

Low Risk
Localized auth config cleanup and registry/test updates; no changes to token handling, push staging, or network behavior beyond clearer category gating.

Overview
Auth:logout now clears active_client_id along with token and email so a later login as another user does not keep showing the previous account’s active client in auth status / client list.

Push categories:token_classification is added to the category registry as known but not CLI-supported (with an unsupported note), so dataset push --category=token_classification is no longer rejected as “unrecognized” when the ingest schema already allows it.

Tests: Logout coverage asserts the active client is cleared. TestRegistryCoversSchemaCategories parses the embedded ingest schema’s category enum and requires every value to be registry-known, reducing future schema-only drift without hand-maintained lists.

^{Reviewed by Cursor Bugbot for commit 321c0f1. Bugbot is set up for automated code reviews on this repo. Configure here.}