feat(update): add default-org cmd to set user default organization

[mbevc1]

Adds kosli update default-org ORG-NAME which calls PUT /api/v2/user/{org} to set the default organization for the currently authenticated user.

[claude]

Claude finished @mbevc1's task in 1m 50s —— View job

---

Claude Code Review

• Gather context & read changed files
• Static analysis (go build, go vet, go mod tidy)
• Code review (quality, edge cases, bugs, tests, security)
• Post review summary

---

Verdict: looks good to merge. Small, well-scoped vertical slice that follows the repo's established command patterns closely.

Static analysis

Check	Result
go build ./...	✅ passes
go vet ./cmd/...	✅ passes
go.mod / go.sum	✅ no changes (stdlib + existing requests/cobra only)

What's good

• Consistent with conventions — newUpdateCmd mirrors newRotateCmd exactly (parent command with Short/Long/aliases + a single subcommand), and updateDefaultOrg.go follows the same PreRunE → RequireGlobalFlags → RunE → url.JoinPath → kosliClient.Do shape used across the codebase (archiveEnvironment.go, renameEnvironment.go, etc.).
• url.JoinPath is the right call — it percent-escapes the org-name path segment, so odd characters in ORG-NAME are handled safely.
• Good test coverage — the suite exercises the happy path, dry-run URL construction, too-few/too-many args, empty-string arg, and the access-denied path. That's a thorough set for a slice this size.
• The earlier review note about LongDesc being a bare alias of ShortDesc is already resolved (commit df0caad4) — the long description now explains the behavior. 👍

Minor observations (non-blocking)

1. out io.Writer is unused in both newUpdateCmd and newUpdateDefaultOrgCmd — output goes through the package logger instead. This matches the existing convention (e.g. rotate.go), so it's fine to leave; just noting it's threaded but never written to.
2. Dry-run success feedback — on --dry-run the "default organization is set to: …" line is intentionally suppressed and the requests client prints the "would have been sent to" message instead. Tested and correct; just confirming the behavior is deliberate.
3. Optional: the long description says the default org is used "by Kosli Web UI when logging in," whereas the original review suggestion framed it as the org used when --org is omitted on the CLI. Worth double-checking which is actually true server-side so the docs reflect the real effect — but this is a wording nit, not a code issue.

No bugs, security, or performance concerns spotted. Nice clean PR.
· 20260626_cmd_org