RFC-0001 · P1 · cli — auth: internal/api + internal/config + login / logout / auth status

[LukasWodka]

New internal/api (backend REST client + CLIENT_ENV→{dev,stg,prod} base URL + proxy/CA-aware HTTP — honor HTTPS_PROXY/NO_PROXY + system cert pool). New internal/config (~/.tracebloc, 0600, user token + active client). Commands under a new auth parent: tracebloc login (device flow: POST /device/code, print URL+code, poll /device/token, store token), logout, auth status.

Depends on the backend device-grant (the /device/* endpoints). Repo: tracebloc/cli. Part of tracebloc/backend#830.

[LukasWodka]

Shipped: login / logout / auth status + internal/api + internal/config landed via cli#85/#86 and have been live since v0.4.0 (device flow verified in production). Board hygiene audit 2026-07-07 with Lukas.