feat(cli): add Jira invite-user command

[ayushtr-aws]

Area

• cdk — infrastructure, handlers, constructs
• agent — Python runtime / Docker image
• cli — bgagent client
• docs — guides or design sources (docs/guides/, docs/design/)
• tooling — root mise.toml, scripts, CI workflows

Related

Closes #553

Changes

• Add bgagent jira invite-user <cloud-id> <account-id-or-email> to mint Jira identity-link invite codes.
• Resolve Jira users through the tenant OAuth token, refresh expired tokens, and write pending#<code> rows consumed by the existing bgagent jira link <code> flow.
• Update Jira setup docs and regenerate the Starlight mirror.

Validation

• Manually verified invite + redeem flow against tenant 83f2ac74-f60e-4053-9514-a887d6ef5fd7.
• npx jest test/commands/jira.test.ts --coverage=false
• MISE_EXPERIMENTAL=1 mise //cli:build
• MISE_EXPERIMENTAL=1 mise //docs:build
• mise run build

PR checklist

• Unit test added
• Integration test added (not applicable: no new CloudFormation resource types or cross-service configuration)
• Documentation updated
• Title follows conventional commits
• Breaking changes documented in commit body (not applicable: no breaking changes)

Acknowledgment

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of the project license.

[codecov-commenter]

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 87.34177% with 40 lines in your changes missing coverage. Please review.
⚠️ Please upload report for BASE (main@092361e). Learn more about missing BASE report.

Files with missing lines	Patch %	Lines
cli/src/commands/jira.ts	87.34%	40 Missing ⚠️
❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #559   +/-   ##
=======================================
  Coverage        ?   89.08%           
=======================================
  Files           ?      222           
  Lines           ?    53332           
  Branches        ?     5607           
=======================================
  Hits            ?    47509           
  Misses          ?     5823           
  Partials        ?        0           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[krokoko]

Thanks for this — it cleanly completes the missing half of the Jira identity-linking flow (#553) and lines up well with the existing jira link handler and the Linear invite-user pattern. The user-resolution logic, token refresh, test coverage, and doc updates all look solid. CI is green from what I can see.

A few small items I'd appreciate addressed before merge:

1. Deduplicate generateInviteCode — linear.ts already has an identical implementation (alphabet, link- prefix, crypto.getRandomValues). Could you extract this to a shared module (e.g. cli/src/invite-code.ts) and import it from both linear.ts and jira.ts? That avoids the require('crypto') + eslint-disable in the Jira copy.

2. Move parseStoredJiraOauthToken to jira-oauth.ts — The ~30 lines of secret validation would fit naturally alongside the other OAuth helpers and keeps jira.ts focused on command wiring.

3. Warn when the user is already linked — Before writing a pending# row, a quick GetCommand on <cloudId>#<accountId> with status: active would let the admin know the teammate is already mapped. Linear doesn't do this either, so a warning (not a hard error) is fine.

4. Update cli/README.md — The Jira setup guide is updated, but cli/README.md still doesn't mention bgagent jira invite-user. A short entry alongside the other Jira subcommands would help discoverability.

5. A few more test cases for the uncovered branches — Codecov flagged ~40 missing lines. Tests for inactive/app accounts, malformed OAuth secret JSON, and missing stack outputs would close the gap without much effort.

None of these are architectural concerns — the core flow, DynamoDB row shape, and handler contract all look correct. Happy to re-review once the above are in.