Epic: gh-style commands for Source Cooperative #21

Tracks the CLI half of source-cooperative/source.coop#588.

Goal

source-coop becomes to Source Cooperative what gh is to GitHub: every task a person can do in the web UI can be done from a terminal or a script. The CLI already handles login (OIDC with PKCE) and STS credentials. This epic adds commands on top of the /api/v1 endpoints that the source.coop epic builds. Those endpoints enforce exactly the same validation as the web UI, so the CLI validates nothing itself: it sends the request and shows the API's field_errors.

Conveniences, modeled on gh

• source-coop api <method> <path> [-f key=value] [--input file]: the gh api equivalent. It works with any endpoint as soon as the endpoint ships, before a dedicated command exists. Build it first.
• --json <fields> and --jq <expr> on every read, and a table when output is a TTY.
• --web opens the matching source.coop page.
• account/product shorthand, e.g. source-coop product view radiant/landcover.
• Interactive prompts for missing required arguments when a TTY is attached, and none otherwise.
• Authentication through the existing cached login, or a service account's API key (feat: exchange a service account's API key without a browser #20), sent as Authorization: Bearer.
• --help and any generated request types come from the published OpenAPI document at source.coop/api/openapi.

Commands

Each command group depends on the source.coop sub-issue that ships its endpoints.

• api: needs only the existing API
• auth status: GET /whoami (API: accounts, organizations and profiles source.coop#592)
• product list | view | create | edit | delete (API: product list, create, view, edit and delete source.coop#590)
• product mirror list | add | edit | remove (API: product mirrors source.coop#591)
• member list | add | edit | remove, invite list | accept | reject (API foundation: one operation behind each server action and route, with generated OpenAPI docs (memberships pilot) source.coop#589)
• org create, account view | edit | search (API: accounts, organizations and profiles source.coop#592)
• connection list | view | create | edit | delete (API: data connections, including account-owned ones source.coop#593)
• service-account list | create | disable | delete, service-account trust add | remove (SERVICE_source-cooperative/source.coop#592), and service-account key create | revoke (feat(accounts): issue, revoke and expire opaque API keys for service accounts source.coop#570)
• ls | cp | rm | sync for product files, run against the data proxy's S3 API with the CLI's own STS credentials. These need no source.coop endpoint.

repo info (#16) folds into product view --json once the product endpoints land.

Docs

docs.source.coop docs/using-source/ gains a CLI path wherever a flow gets one.