Enhancement: Authentication is currently only via user/pass, request API Client, too

Currently, access is stored as `user@customer:password`, and calls with header values to match.

API Clients requires the header to pass `bearer` values, using access tokens obtained via OAuth.

The issue names no files, tests, or entry points. Start by locating the current user@customer:password authentication and header-matching flow, then trace how command requests are assembled; done requires a decided scope for OAuth bearer-token support and API Client authentication, with tests covering the accepted headers and token flow.

Written by the indexing model from the issue text.