docs: replace bitbucket app password references with API tokens

[AlexKantor87]

Why

Bitbucket Cloud permanently removes app password authentication on 28 July 2026 (brownouts have been running since 9 June). Flagged by the weekly deprecation scanner: https://github.com/kosli-dev/external-dependencies/issues/24

What

Help-text only — no behaviour change. The CLI already supports the replacement:

• Atlassian API tokens work exactly like app passwords did: Basic auth via --bitbucket-username (now the Atlassian account email) + --bitbucket-password
• --bitbucket-access-token (repo/project/workspace tokens, Bearer auth) is unaffected and remains the recommended option

Updated the flag descriptions in root.go and the long help in kosli attest pullrequest bitbucket / kosli assert pullrequest bitbucket. The generated pages on docs.kosli.com pick this up via the usual live-docs sync.

Testing

• make build and make lint pass; help output verified by running the built binary
• No golden files reference the changed text (grepped cmd/kosli/testdata/)
• Full integration suite not run: it requires KOSLI_API_TOKEN_PROD + the local server stack, and the change is limited to three string constants

🤖 Generated with Claude Code

[claude]

Claude finished @AlexKantor87's task in 1m 29s —— View job

---

Review: docs — replace Bitbucket app password references with API tokens

• Static analysis (go build, go vet)
• Review help-text changes
• Check for related references needing updates
• Post review

Verdict: LGTM ✅ — a clean, accurate, docs-only change.

Static analysis

Check	Result
go build ./...	✅ pass
go vet ./cmd/kosli/	✅ pass

Correctness of the claim

I verified the PR's core assertion against the code. In internal/bitbucket/bitbucket.go, the requests pass Username + Password as Basic-auth credentials alongside the Bearer Token:

reqParams := &requests.RequestParams{
    Method:   http.MethodGet,
    URL:      url,
    Username: c.Username,   // Atlassian account email
    Password: c.Password,   // API token (formerly app password)
    Token:    c.AccessToken,
}

Atlassian API tokens authenticate over Basic auth exactly like app passwords did, so the "no behaviour change" claim holds — the CLI already supports the replacement. 👍

Reference completeness

Grepped for lingering "app password" mentions: the only remaining hits are the three intentionally-updated strings (root.go, attestPRBitbucket.go, assertPRBitbucket.go), each now framed as "no longer supported." No other docs, help text, or comments reference app passwords. Nothing missed.

Minor observations (non-blocking)

• Flag name vs. description mismatch is unavoidable and handled well. --bitbucket-password now documents "Bitbucket API token"; renaming the flag would break backward compatibility, so clarifying in the description (rather than renaming) is the right call.
• Wording consistency: the long descriptions in assert/attest say "an access token (recommended) or an Atlassian API token", while bbPasswordFlag in root.go just says "Bitbucket API token". Consistent enough given the different contexts — no change needed.
• Date-relative phrasing: "no longer supported as of 28 July 2026" is a hard date rather than relative language, which is good for generated docs that may be read long after this ships.

Testing

Agree with the author that the integration suite is unnecessary here — the change is limited to string constants, no golden files reference the text (confirmed via grep of cmd/kosli/testdata/), and go build/go vet pass.

Nice, well-scoped change with a clear rationale linking back to the deprecation source. 🎉