feat: add system account access token resource support

[singhvishalkr]

Summary

Adds full CRUD command support for managing system account access tokens via the Konnect Identity v3 API, addressing #259.

New commands

# List all access tokens for a system account
kongctl get system-account access-token <account-id|name>

# Get a specific access token
kongctl get system-account access-token <account-id|name> <token-id>

# Create a new access token
kongctl create system-account access-token <account-id|name> --name ci-token --expires-at 2027-01-01T00:00:00Z

# Delete an access token
kongctl delete system-account access-token <account-id|name> <token-id>

Changes

• internal/konnect/helpers/system_account_access_tokens.go -- New SystemAccountAccessTokenAPI interface and SystemAccountAccessTokenAPIImpl wrapping the SDK SystemAccountsAccessTokens methods (list, get, create, delete).
• internal/konnect/helpers/sdk.go -- Added GetSystemAccountAccessTokenAPI() to the SDKAPI interface and KonnectSDK implementation.
• internal/konnect/helpers/sdk_mock.go -- Added mock factory and getter for SystemAccountAccessTokenAPI.
• internal/cmd/.../systemaccount/accesstoken/ -- New command package:
  • accesstoken.go -- Command factory routing get/create/delete verbs
  • getAccessToken.go -- List and single-get with paginated fetch, name-based system account resolution, table rendering, and interactive child view
  • createAccessToken.go -- Create with --name and --expires-at flags; displays the one-time token value
  • deleteAccessToken.go -- Delete with confirmation prompt
  • interactive_children.go -- Registers TUI child loader for drilling from system accounts to access tokens
• internal/cmd/.../systemaccount/systemaccount.go -- Wires access-token as a child subcommand for get, create, and delete verbs.

Design decisions

• Separate API interface (SystemAccountAccessTokenAPI) rather than extending SystemAccountAPI, consistent with the project pattern of one interface per API resource area.
• System account resolution by name: the first positional arg accepts either a UUID or name; names are resolved via filtered list.
• Interactive navigation: registered under parent type system-account so the TUI drill-down flows naturally from organization > system-account > access-tokens.

Testing

• Unit and integration tests are deferred to a follow-up (Go toolchain not available in the current dev environment). CI will verify compilation.

Closes #259

[CLAassistant]

All committers have signed the CLA.

[singhvishalkr]

Hi maintainers — I've pushed a follow-up cleanup commit: removed an unused struct, added cobra.RangeArgs(1, 2) for proper arg validation on the get command, and fixed tab alignment in the mock file. Happy to add unit tests if you'd like — just let me know the preferred test patterns/fixtures for this area of the codebase.

[rspurgeon]

@singhvishalkr Thank you very much for your contribution. The associated issue, it's parent issue and all it's children are related to declarative configuration support we are exploring for our Konnect Organization level support. We don't yet have the UX designed for how we want these items represented in the solution. There is some existing design already designing around a organization key in the CLI UX so I'm not sure the solution here matches what we want. The issue description is, admit-tingly, vague. I'm going to move your PR to draft until we have time to review the plans for all the organization level items. Again, thank you for the contribution, I will try and incorporate when our designs and plans are more solidified.

[singhvishalkr]

Thanks for the context, @rspurgeon. Completely understand -- makes sense to align this with the broader Organization-level declarative config design before committing to a specific CLI representation.

Happy to adapt the implementation once the UX and organization key design are solidified. Feel free to ping me when the time comes, and I'll update accordingly.