feat: add --team to authorizations:info and authorizations:update

[michaelmalave]

Summary

Adds a --team option to heroku authorizations:info and heroku authorizations:update so an admin can inspect and modify an OAuth authorization owned by a team, not just their own personal tokens. Without the flag, both commands behave exactly as before.

• Add --team (shared flags.team() helper) to authorizations:info and authorizations:update.
• Route the GET (info) and PATCH (update) to /teams/{team}/oauth/authorizations/{id} when --team is set; keep the existing /oauth/authorizations/{id} path otherwise.
• Add unit tests covering both the team and non-team paths for each command.

Type of Change

Feature Additions (minor semver update)

• feat: Introduces a new feature to the codebase

Testing

Notes:
Automated: scoped authorizations unit suite is green (npm run test:ci:unit is chronically broken on cli main independent of this diff, so verification runs the scoped suite). Live smoke exercises the real team-authorizations endpoint that unit tests mock.

npx mocha --config .mocharc.json "test/unit/commands/authorizations/**/*.unit.test.ts"

Steps:

1. git fetch origin worker/gus-a3QEE000002hXIv2AM-2026-09-14-task-1 && git checkout worker/gus-a3QEE000002hXIv2AM-2026-09-14-task-1
2. npm ci && npm run build
3. heroku login
4. ./bin/run authorizations:info <AUTHORIZATION_ID> --team <TEAM> — Expect: prints the team-owned authorization
5. ./bin/run authorizations:info <AUTHORIZATION_ID> --team <TEAM> --json — Expect: same, as JSON
6. ./bin/run authorizations:update <AUTHORIZATION_ID> --team <TEAM> --description "smoke test" — Expect: updates the team-owned authorization
7. ./bin/run authorizations:info <PERSONAL_AUTHORIZATION_ID> — Expect: unchanged personal-token behavior (no --team)

Additional Context

flags.team() (the shared @heroku-cli/command helper reused here, as in apps/members) carries an env-var default: --org → HEROKU_TEAM → HEROKU_ORGANIZATION. So a user with HEROKU_TEAM/HEROKU_ORGANIZATION exported will be routed to the team endpoint even without passing --team. This matches existing team-scoped commands; flagging it because these two commands did not previously have a team flag.

Related Issues

GUS work item: W-24132434

[michaelmalave]

Closing: no CLI change required. There is no team-scoped GET/PATCH /teams/{team}/oauth/authorizations/{id} route — only the collection routes (list/create) are team-scoped. A team-owned token is read and updated by its UUID through the existing heroku authorizations:info <uuid> / heroku authorizations:update <uuid> commands: the Platform API resolves a team-owned token by UUID via find_team_authorization! and authorizes on the manage_tokens capability. So the capability this PR aimed to add already ships today with no code change; adding a --team flag here would route to an endpoint that 404s. Tracked under W-24132434 — see #3928 for the collection-level team work.