token CLI ignores global --data-dir for daemon socket detection (missed by #854)

[Dumbris]

Summary

The mcpproxy token subcommands (create, list, show, revoke) ignore the global --data-dir flag when locating the daemon socket, so they cannot talk to a daemon running on a non-default data directory. This is the same class of bug fixed for doctor/auth/call/code/tools in #854 — token was not included in that pass.

Root cause

newTokenCLIClient() in cmd/mcpproxy/token_cmd.go loads config with a bare config.Load() and derives the socket path from whatever data dir that returns:

// cmd/mcpproxy/token_cmd.go:127
func newTokenCLIClient() (*cliclient.Client, *config.Config, error) {
	cfg, err := config.Load()          // <-- ignores global --data-dir
	...
	socketPath := socket.DetectSocketPath(cfg.DataDir)  // wrong data dir
	...
}

The already-fixed loaders instead thread the resolved globalConfig.DataDir through, e.g. doctor_cmd.go:

// cmd/mcpproxy/doctor_cmd.go:110
func shouldUseDoctorDaemon(dataDir string) bool {
	socketPath := socket.DetectSocketPath(dataDir)
	...
}

Because newTokenCLIClient never applies the --data-dir override, a command like:

mcpproxy token create --name x --servers "*" --permissions read --data-dir /tmp/mydatadir

detects the default socket (~/.mcpproxy/mcpproxy.sock) instead of /tmp/mydatadir/mcpproxy.sock, and reports mcpproxy daemon is not reachable even though a daemon is running there.

Reproduction (found during v0.52.0-rc.2 QA)

1. Start a daemon on a scratch data dir: mcpproxy serve --config /tmp/q52/mcp_config.json --data-dir /tmp/q52
2. mcpproxy upstream list --data-dir /tmp/q52 → works (this loader honors --data-dir, fix(cli): honor global --data-dir flag in doctor, auth, call, code, and tools config loaders #854).
3. mcpproxy token create --name qa --servers "*" --permissions read --data-dir /tmp/q52 → Error: mcpproxy daemon is not reachable.

Minting the token via POST /api/v1/tokens against the same daemon works, confirming the daemon and token subsystem are fine — only the CLI socket detection is wrong.

Suggested fix

Apply the --data-dir override in newTokenCLIClient the same way the #854 loaders do — pass the resolved globalConfig.DataDir into config loading / socket.DetectSocketPath, rather than relying on config.Load()'s default. Extract or reuse the shared daemon-client construction the other five commands adopted so token can't drift again. Add a regression test alongside datadir_flag_test.go covering the token loaders.

Scope / severity

Low-to-medium. Default-data-dir usage (the common case) is unaffected; this only bites when --data-dir is passed (custom/isolated instances, CI, multi-instance setups). Not a v0.52.0-rc.2 regression — pre-existing since token was added.