feat(cli): client create reads the cluster anchor — idempotent get-or-create + 409 (#84)

[LukasWodka]

What

Revises tracebloc client create to be idempotent on the cluster anchor (RFC-0001 §7.2, against the backend#883 / Appendix C.3 contract). Re-running on the same cluster now adopts the existing client instead of minting a duplicate.

• Reads the cluster anchor — new cluster.ClusterID returns the kube-system namespace UID (the stable per-cluster fingerprint). client create sends it as cluster_id, behind --kubeconfig / --context (kubectl conventions, mirroring cluster info).
• Best-effort + never-silent: if the cluster isn't reachable, it provisions without an anchor (a plain mint) and prints a clear hint that re-runs won't be idempotent — it never blocks.
• api.CreateClient reports adopt (HTTP 200) vs mint (201):
  • mint → prints the machine credential (interim — see scope below).
  • adopt → "this cluster is already registered as client X — adopted it", no credential reprinted (the existing one stands; the backend keeps the existing identity per §7.2).
  • 409 → a clear "registered to a different tracebloc account" (cluster_conflict, R6); 403 still routes to ask-an-admin.

Scope (locked: anchor + idempotency only)

Deferred to the installer reorder (#838), where the installer owns writing the credential into the cluster secret and knows the in-cluster TB_CLIENT_ID:

• never-show (writing the credential into a 0600 cluster/Helm secret instead of printing it) — the mint-time print stays as the interim.
• R7 existing-fleet backfill (matching a live TB_CLIENT_ID whose cluster_id is null and PATCHing it). The PATCH primitive lands with its caller in #838, not here — so this PR ships no unused/dead API surface.

Tests

go build / vet / test ./... green (Go 1.26):

• cluster.clusterIDFrom via a fake clientset (reads kube-system UID; missing-namespace errors).
• api.CreateClient mint/adopt (status→adopted) + 409→APIError.
• cli create: anchor-mint (asserts cluster_id is sent), adopt-idempotency over two runs (both adopt the same id, no credential reprinted, password still sent in the body), 409→friendly message, and no-anchor→full mint + never-silent hint.

Reviewer notes

• Built against backend#883 (the cluster_id anchor — get-or-create + 409 + adopt), currently in review. The CLI sends string(ns.UID) (already clean), so it's robust regardless of the backend's input canonicalization.
• Adversarially reviewed (correctness/UX-safety, contract-match, test-genuineness) before pushing; findings folded in: dropped the not-yet-called PATCH primitive (→ #838), made the adopt-idempotency test load-bearing, and reordered the mint path so a config-save failure can't cost the user the only copy of the credential.

Closes part of #84 (the create revision); list/use/picker + selected-vs-connected remain.

🤖 Generated with Claude Code

[saadqbal]

Two refinements from review — both small, neither blocking. Details inline.

[LukasWodka]

Ready for another look @saadqbal:

• Both your comments fixed in fb92d457 — bounded the anchor read (8s clusterIDReadTimeout) and made the adopt path's cfg.Save() failure a non-fatal hint (mirrors mint). Replied + resolved both threads.
• Synced develop (now incl. chore(schema): re-vendor ingest.v1.json from data-ingestors (fix drift check) #103) → the inherited Schema drift check is green.

Code-complete, 0 unresolved threads; just needs your re-review.