feat(cli): add nself server for Hetzner server lifecycle (G-011)

[acamarata]

Summary

Closes gap G-011: nself server (provision / list / resize / destroy), backed by a new internal/server package talking to the Hetzner Cloud API. Previously an operator provisioning or destroying a server had no CLI path — nself access only manages SSH keys on an already-deployed host, and nself security only audits one — and fell back to raw hcloud server create / hcloud server delete, with none of the safety a manual snapshot-and-verify procedure gives.

Design requirements -> implementation

1. destroy refuses to run without a verified backup. internal/server/destroy.go's ErrNoBackup gate requires --snapshot (takes one via internal/server/snapshot.go's TakeVerifiedSnapshot, polling until the image reaches status=available before returning) or an explicit --force-no-backup. A snapshot that fails or times out aborts destroy before the server is ever deleted.
2. destroy protects the primary IP by default. internal/server/primaryip.go's ProtectOrReleaseIPs sets auto_delete=false on the server's primary IP(s) before deletion, unless --release-ip is passed (which explicitly sets auto_delete=true instead of merely "leaving it alone"). The command prints which IPs were retained vs. released, read back from what was actually set — never assumed from the flag.
3. resize explains disk-shrink instead of raw-erroring. internal/server/resize.go compares the current and target server types' disk sizes before calling the provider and returns ErrDiskShrink with the snapshot -> new server -> restore workaround spelled out, when Hetzner itself would only return invalid_input.
4. Token resolution, never hardcoded. internal/server/token.go's ResolveToken checks --token > --token-env (defaults to the existing HETZNER_NSELF_TOKEN vault var, so any other project's own token var works via --token-env without a code change) > HCLOUD_TOKEN.

Other changes

• +1 on the CLI-R11 command-surface budget (50 -> 51, .github/command-surface-budget.txt), the same deliberate-exception pattern already used for access (nself access: manage SSH keys/users on already-deployed servers #238).
• Regenerated .github/command-inventory.json, .github/wiki/Commands.md, .github/surface-parity.{md,json}, and SPORT F02-COMMAND-INVENTORY.md.
• Added .github/wiki/cmd-server.md (T03 template).
• cmd/commands/groups.go + error_harness_test.go: registered server in the Advanced & Enterprise help group and the error-state harness.

Test plan

• internal/server: 35 unit tests against a hand-written fake Client (no network) plus 4 httptest.Server-backed tests proving the real Hetzner HTTP request/response wire format — covers the backup gate, IP protection, disk-shrink detection, snapshot polling (success/error/timeout), and token resolution.
• cmd/commands: 8 tests against a fake server.Client injected via the newServerClient indirection (mirrors newAccessTransport) — no network, no real infrastructure ever touched.
• go build ./..., go vet ./..., gofmt -l . clean.
• golangci-lint run clean (fixed 3 staticcheck S1016 findings).
• Full go test ./... green, including internal/repoqa's command-inventory/parity/surface-budget/wiki-parity gates.