feat(cli): client create / list / use commands (#84)

[LukasWodka]

Summary

RFC-0001 · P1 · the client command subtree the login flow (cli#85) hands off to. After tracebloc login, a user provisions this machine as a tracebloc client, lists the account's clients, or attaches this machine to an existing one.

Closes#84.

What's here

• internal/slug — Go port of RFC-0001 Appendix B (backend/common/utils/slug.py): DNS-1123 slugify (NFKD transliteration via golang.org/x/text), collision suffix (-2, -3, …), 63-char cap, empty-slug guard. Kept in lock-step with the Python definition because the backend validates exactly what this produces (RFC-0001 backend#830; namespace validation in backend#836).
• internal/api — CreateClient (POST /edge-device/), ListClients (GET /edge-device/), ListClientAdmins (GET /edge-device/admins/), all Bearer-authed (backend#836).
• internal/cli/client.go — client create (--name, --location, --yes), client list (alias ls), client use <id>.

Behavior

• name → namespace: derived via the slug port, shown for confirmation; collisions against existing namespaces get a numeric suffix.
• location: --location or an interactive prompt; never silent-empty (the prompt requires a value).
• permissions: a 403 from the backend (no CLIENT_WRITE) surfaces the ask-an-admin path — the CLI lists who in the account can provision (backend#836).
• credential: the CLI generates the machine password (crypto/rand), sends it on create, and prints it once for the installer.
• non-interactive: with --name/--location given (or no TTY — CI, pipes) it never prompts; missing required values error instead of blocking.

Deferred (fast-follow)

Location auto-detect (cloud instance-metadata first, GeoIP fallback) — the suggested default. This PR requires --location or a prompt; the auto-detect suggestion layers on top without changing the interface.

Tests

• internal/slug: Appendix B cases (transliteration, dash-collapse, 63-cap, collision suffix, empty+fallback, empty+no-fallback error).
• internal/cli: create success (asserts namespace slug + credential + active-client persisted + Bearer header), ask-an-admin 403 path, requires-login, list, use (+ unknown-id error). Backend stubbed via the newAPIClient seam + httptest.
• go build, go vet, full go test ./... green.

🤖 Generated with Claude Code

[LukasWodka]

Self-review pass — hardened in 8058b1b

Reviewed this PR against the actual #862 contract (pulled the serializer/view, not from memory) and verified the slug port empirically.

Slug parity — proven, not eyeballed. Ran 24 adversarial inputs through both the canonical Python slugify_dns1123 (origin/develop) and the Go Slugify: byte-identical across all of them — NFKD ligatures (fi→fi), vulgar fractions (½→12), roman numerals (Ⅻ→xii), fullwidth, CJK/emoji drops, accent folding. Locked in as a committed golden test (slug_golden_test.go) so it can't silently drift from the backend validator.

Fixed in this push

• ListClients read only page 1 of a paginated endpoint → now follows DRF next to the end, so list / use <id> / create-time collision detection see every client in the account.
• create confirmed mid-flow → now gathers name + location first, then one review + a single confirm (matches the dataset push interactive flow).
• Tests added: interactive create + cancel (prompter seam), paginated list, collision-suffix end-to-end.

Verified correct against #862: account stamped server-side (client correctly omits it; spoof-safe), admins → [{name,email}], 403 → ask-an-admin, Bearer auth, write-only password, response fields all present.

Deferred / cross-repo (not in this PR)

• Location auto-detect (cloud-metadata → GeoIP suggested default) — fast-follow; the flag/prompt interface is forward-compatible.
• Namespace uniqueness isn't enforced server-side (EdgeDevice.namespace has no unique=True), so the client-side collision suffix is advisory + racy (TOCTOU). Raising this on #862 — only a DB constraint can actually guarantee it.