feat(analytics): show session detail and list participants under --experimental-auth

[Topherhindman]

Fixes DEVX-793
Based on main.
Depends on livekit/public-api-server#48.

Under --experimental-auth, lk analytics session get now prints the session detail the Public API returns: totals, a summary of each timeline, and the first page of participants. The new lk analytics session participant list pages through the rest. This PR also adds the pieces the later session reads in this stack share: PageOptions, pageFlags and sessionRead.

What changed

• Regenerated client (chore(public)): oapi.gen.go is regenerated from livekit/public-api-server@1124a4d. It picks up the session detail's participants page, connection seconds (was connection minutes), the session detail losing room_id, ListSessionParticipants' sort_by and sort_order, and the removal of the transcript recording file type. Nothing hand-written reads the changed types, so only oapi.gen.go changes.
• Client (feat(public)):
  • GetSession returns the detail next to the list row. The detail is nil while the server is still finalizing it.
  • ListSessionParticipants returns one page of a session's participants and the cursor for the next. ParticipantListOptions takes friendly sort names (joined or left, asc or desc), like SessionListOptions. Its Validate rejects a negative limit or an unknown name before any request is sent.
  • PageOptions holds a page's limit and cursor, with its own negative-limit check and query params, so every session read that pages can share it.
• Command (feat(analytics)):
  • session get prints the list row, then the totals (bandwidth in and out, connection time), one row per timeline (points, and average and peak over non-empty buckets), and the first page of participants. --json prints the API's own {session, detail} response, every timeline point included. A session whose detail is still being finalized prints its row and says so.
  • When more participants remain, session get prints a hint with the full lk analytics session participant list command and the detail's cursor. When the detail couldn't read them, the hint names the listing alone. Both say to use the same flags as session get, which carry --experimental-auth and --project.
  • session participant list SESSION_ID pages a session's participants, one row per identity. --json prints {items, nextCursor}.
  • sessionRead builds the action of a session read that only the Public API serves. It refuses to run without --experimental-auth before anything else. Then it reads SESSION_ID and the options, so a bad flag fails before the project lookup. pageFlags and pageOptions declare and read --limit and --cursor.
  • A permission denial says the user doesn't have access to the project. cloudAPIError would suggest API-key credentials, which this read can't use.

Usage

lk --experimental-auth analytics --experimental session get SESSION_ID [--json]
lk --experimental-auth analytics --experimental session participant list SESSION_ID \
    [--sort-by joined|left] [--sort-order asc|desc] [--limit N] [--json]

• Participant list: newest join first by default. --limit defaults to 50, and the server caps a page at 100.
• Paging: --cursor is hidden. A page with more after it prints a hint to re-run with its --cursor.
• Auth: without --experimental-auth, session participant list fails with this command is only available under --experimental-auth (user-based auth). session get keeps using the API-key endpoint there.

session get prints the totals, then the timelines and participants, and ends with the hint when more participants remain:

┌──────────────┬───────────────┬─────────────────┐
│ Bandwidth In │ Bandwidth Out │ Connection Time │
├──────────────┼───────────────┼─────────────────┤
│ 1.5 MB       │ 2.5 KB        │ 1h2m3s          │
└──────────────┴───────────────┴─────────────────┘
...
More participants available — list them with lk analytics session participant list RM_1 --cursor c2, using the same flags as this command

Since review

• 8fc74ad fix(analytics): print the participant list hint as a full lk command
• 7f2b295 fix(analytics): strip terminal escapes from participant identities and names
• ca73a04 fix(analytics): say a participant page is empty only when the server would
• 1b3665b fix(analytics): name the project when a participant list isn't found
• af22fee fix(analytics): strip terminal escapes from room names

Testing

• go build ./..., go vet ./pkg/... ./cmd/lk/ and go test ./pkg/... ./cmd/lk/ pass on every commit.
• New tests:
  • pkg/public: TestGetSessionReturnsDetail (the detail, and nil while finalizing), TestGetSessionMissingSession, TestListSessionParticipantsQuery and TestListSessionParticipantsRejectsBadOptions.
  • pkg/public/render: TestSessionDetailText, TestSessionDetailTextLastParticipantsPage, TestSessionDetailTextParticipantsUnread, TestSessionDetailTextFinalizing, TestSessionDetailJSON and TestSessionParticipantsPage.
  • cmd/lk: TestParticipantListOptions, TestParticipantListRequiresExperimentalAuth, TestFetchSessionParticipants, TestFetchSessionParticipantsErrors and TestSessionAPIError.
• The commands above were run on staging on 2026-10-08, against public-api-server's stack run locally, with a real sign-in and staging data.

Before merge

• The client is generated from livekit/public-api-server@1124a4d, Update actions/checkout action to v3 #48's branch tip, which isn't on main: Update actions/checkout action to v3 #48 was squash-merged. Regenerate from public-api-server main so the Generated from line names a main commit.

Not in this PR

• API-key mode: the API-key analytics endpoint has no participant listing.
• Participant sessions: one row per connection, with the client each connected from, come in DEVX-800 at the top of this stack.