fix(cli): resolve CLI-002..007 — robust response rendering, URL/JSON arg validation, credential env-vars, doc refresh

src/ScadaLink.CLI/CliConfig.cs

@@ -7,6 +7,20 @@ public class CliConfig
     public string? ManagementUrl { get; set; }
     public string DefaultFormat { get; set; } = "json";
 
+    /// <summary>
+    /// LDAP username from the <c>SCADALINK_USERNAME</c> environment variable, if set.
+    /// Credentials are intentionally only sourced from environment variables (or the
+    /// command line) — never from the config file — so they are not persisted to disk.
+    /// </summary>
+    public string? Username { get; set; }
+
+    /// <summary>
+    /// LDAP password from the <c>SCADALINK_PASSWORD</c> environment variable, if set.
+    /// Provides a safer alternative to <c>--password</c>, which leaks into process
+    /// listings and shell history.
+    /// </summary>
+    public string? Password { get; set; }
+
     public static CliConfig Load()
     {
         var config = new CliConfig();
@@ -38,6 +52,15 @@ public class CliConfig
         if (!string.IsNullOrEmpty(envFormat))
             config.DefaultFormat = envFormat;
 
+        // Credentials from environment variables only (never the config file).
+        var envUsername = Environment.GetEnvironmentVariable("SCADALINK_USERNAME");
+        if (!string.IsNullOrEmpty(envUsername))
+            config.Username = envUsername;
+
+        var envPassword = Environment.GetEnvironmentVariable("SCADALINK_PASSWORD");
+        if (!string.IsNullOrEmpty(envPassword))
+            config.Password = envPassword;
+
         return config;
     }