fix(#6831): add authentication preflight to Jira poller

[fullsend-ai-coder]

Summary

Add an authentication preflight check (GetMyself()) to the Jira poller's Run() method, before JQL discovery, lock operations, or checkpoint writes. When credentials are missing, invalid, or belong to an inactive account, the poller now fails fast with a clear authentication error instead of silently returning zero candidates.

Related Issue

Closes #6831

Changes

• Call GetMyself() at the top of Poller.Run() to verify credentials before any other Jira API calls
• Return a clear authentication preflight failed error on API failure (401/403) without exposing credential material
• Reject inactive accounts with a descriptive error mentioning the account ID
• Update newMockClient() to include a default active user so existing tests pass through the preflight
• Add three new tests: auth failure, inactive account, and successful preflight proceeding to discovery

Testing

• TestRun_AuthPreflightFailure — verifies Run returns auth error and SearchIssues is never called
• TestRun_AuthPreflightInactiveAccount — verifies inactive accounts are rejected
• TestRun_AuthPreflightSuccess — verifies normal flow proceeds after successful preflight
• All existing tests pass (mock default provides an active user)
• Patch coverage above 80% threshold

Checklist

• PR title follows Conventional Commits (correct type, ! for breaking changes)
• Commits are signed off (DCO) — human and human-directed agent sessions only
• I wrote this contribution myself and can explain all changes in it

---

Closes #6831

Post-script verification

• Branch is not main/master (agent/6831-jira-auth-preflight)
• Secret scan passed (gitleaks — e3620470427aa7c3bab339aef65cd1ca7552818c..HEAD)
• PR body secret scan passed (gitleaks — no-git)

[fullsend-ai-review]

🤖 Finished Review · ✅ Success · Started 9:35 PM UTC · Completed 9:48 PM UTC

Commit: 0ca7e18 · View workflow run →

Runtime: claude · Model: opus → claude-opus-4-6 · Effort: high · Cost: $3.59

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[fullsend-ai-review]

Risk Assessment: moderate (2/5)

Details

Small focused bug fix (2 files, 105 lines) by a bot author with 50% test file ratio. No protected paths, security-sensitive files, CI, or dependency changes. Tier 2 churn in the jirapoll module is above average but mitigated by the change's narrow scope and clear acceptance criteria coverage.

[fullsend-ai-review]

Review

Findings

Low

• [naming-convention] internal/jirapoll/poller_test.go — New test functions use TestRun_AuthPreflight* naming (underscore immediately after Run), while most existing Run tests use either bare camelCase (TestRunEmptyPoll) or embed a scenario word before the underscore (TestRunHappyPath_CommentWithSlashCommand). However, the TestMethodName_Scenario pattern does appear elsewhere in the file (e.g., TestReadLock_NotFound, TestReadLastCheck_NotFound), so this is a minor inconsistency rather than a convention violation. No action required.