[M2] CLI: server lifecycle + auth + robot-envelope refactor for existing cmds

[quangdang46]

Summary

Second milestone of the agent-first CLI plan. Independent of #10 (M1, already merged).

Adds 8 new subcommands:

group	command	purpose
server	init [--force]	bootstrap empty db.json + print fresh admin key
server	start [--detach] [--host H] [--port P]	run daemon, writes $DATA_DIR/openproxy.pid and $DATA_DIR/openproxy.endpoint sidecars
server	stop	SIGTERM via PID file with 5 s grace + cleanup
server	status	robot envelope reporting PID liveness, /api/health probe, DB summary
auth	login --url <U> --api-key <K> [--profile P]	save profile to ~/.config/openproxy/config.toml, optionally activate as default
auth	logout [--profile P]	remove profile
auth	whoami [--verify]	show currently-resolved identity
auth	list	enumerate configured profiles

Detached mode uses setsid + clean stdio redirect to $DATA_DIR/openproxy.log. server status reads the openproxy.endpoint sidecar to auto-pick the right port.

Refactor (no behaviour change for existing flags):

• provider list/add, key list/add, pool list/status/create/delete, tunnel start/stop/status now emit openproxy.v1.<resource>.<verb> envelopes when --robot is set.
• Legacy --json keeps producing the same pretty-printed JSON it always did.
• route honors --robot by enabling JSON streaming mode (per-event envelope deferred to M3).
• Error paths use output::emit_error() with proper exit codes.

Schemas emitted

• openproxy.v1.server.{init,start,stop,status}
• openproxy.v1.auth.{login,logout,whoami,list}
• openproxy.v1.provider.{list,add}
• openproxy.v1.key.{list,add}
• openproxy.v1.pool.{list,status,create,delete}
• openproxy.v1.tunnel.{start,stop,status}

Test coverage

• Unit tests (6 new): pid file round trip, generated key shape (op-... 48 hex), default_profile_name slug derivation, URL normalisation, login -> logout round trip writing a real TOML file.
• Integration: tests/server_lifecycle.rs spawns the real binary, asserts PID + endpoint sidecar appear, /api/health answers, and stop cleans both sidecars up.
• Full lib suite: 364 passed.
• Manual E2E (transcripts saved): server init -> start --detach -> status -> conflict-on-restart -> provider/key/pool/tunnel --robot envelopes -> auth login/logout/list -> server stop all pass.

Review & Testing Checklist for Human

Risk: yellow (touches binary's process model + writes credentials to disk).

• cargo test is green locally.
• target/debug/openproxy --data-dir /tmp/op-x server init produces a fresh admin key, then server start --detach --port 4733 --host 127.0.0.1 actually backgrounds and curl http://127.0.0.1:4733/api/health returns {"ok":true}. Then server stop exits the child cleanly.
• auth login --url http://127.0.0.1:4733 --api-key <admin> writes ~/.config/openproxy/config.toml with default_profile set and the masked-key envelope is sane.
• Existing scripts that rely on provider list --json / pool list --json still see the same pretty-printed shape.

Notes

• Auth credentials are stored plaintext in ~/.config/openproxy/config.toml (mirrors ~/.netrc, user's explicit choice in M2 scoping).
• M3 will: per-event JSON envelope for route, observability commands (usage, logs, chat), and the remaining 12 command groups in the PLAN.