[RaphaelFakhri]

🔧 Changes

auth0 logs tail --filter <query> drops the log_id:[<last-id> TO *] cursor on every poll. The poll builds two management.Query options, one for the cursor and one for the filter, and management.Query calls q.Set("q", ...), so the filter replaces the cursor and the request only contains q=<filter>.

As a result, each filtered poll fetches the latest 100 matching events instead of the events after the last one shown. Client-side deduplication hides the repeats, but once the tenant has 100 or more events that match the filter, every poll returns a full page, the 2-second back-off never triggers, and the command polls the Management API in a tight loop, which uses up the tenant's Management API rate limit.

This change adds a tailLogsQuery helper that sends a single query that combines both parts, log_id:[<last-id> TO *] AND (<filter>). Tailing without a filter, and the first poll before any log ID is known, send the same query as before.

📚 References

Fixes #1722

🔬 Testing

• New subtest in TestTailLogsCommand runs logs tail --filter type:f, captures the options of the poll request, applies them through management.Management.NewRequest, and checks the resulting q parameter. On main it fails with actual: "type:f", with this change it passes.
• New TestTailLogsQuery covers the four cursor and filter combinations.
• The existing "3rd request" subtest now expects one query option instead of two on the poll requests.
• go test ./internal/... and golangci-lint run -c .golangci.yml ./internal/cli/... pass.

📝 Checklist

• All new/changed/fixed functionality is covered by tests (or N/A)
• I have added documentation for all new/changed functionality (or N/A)