Add CLI tunnel and auth commands

[drewr]

Summary

Add CLI tunnel and auth commands for managing Datum Connect tunnels from the command line.

Changes

• Add nix run .#cli app to flake.nix
• Add tunnel subcommand with list, listen, update, delete commands
• Add auth subcommand with status, login, logout, list, switch commands
• Split find_connector_readonly for read-only list operations (no side effects)
• Default logging to warn level (info via RUST_LOG env var)

Tunnel Commands

Command	Description
tunnel list	Read-only listing of tunnels
tunnel listen	Create/update and run tunnel in foreground
tunnel update	Update tunnel label/endpoint
tunnel delete	Delete a tunnel

Auth Commands

Command	Description
auth status	Show current authentication status
auth login	Log in via browser OAuth with account picker
auth logout	Log out and clear credentials
auth list	Show current authenticated user
auth switch	Log out and prompt for new login

Bug fixes (found during testing)

• Tunnel delete silently no-ops when no connector found: delete_project returned early if find_connector found nothing, skipping deletion of HTTPProxy/ConnectorAdvertisement/TrafficProtectionPolicy. Fixed: connector lookup is now only needed for post-deletion cleanup; resource deletion proceeds regardless.
• Tunnels created from CLI never route traffic: CLI was missing the HeartbeatAgent that continuously patches status.connectionDetails on the connector (relay URL, addresses, public key). Without it the gateway has no routing info. Fixed: tunnel listen now starts the heartbeat and registers the project before enabling the tunnel.
• Re-running tunnel listen on an existing endpoint updates the label unexpectedly: A random label was generated before checking for an existing tunnel, so it always differed and triggered the update prompt. Fixed: random label generation moved into the create-new-tunnel path; existing tunnels reuse their stored label unless --label is explicitly provided.
• Auto-generated label used tunnel-<u16> format (same as resource IDs): Switched to 12 hex chars of random entropy (e.g. a3f9c2e1b047) to distinguish display names from resource names.
• tunnel delete printed confusing (connector deleted: false): Connector cleanup is an internal detail. Output simplified to just Deleted tunnel <id>.

Usage Example

$ nix run .#cli -- tunnel listen --endpoint 127.0.0.1:8080

Created tunnel:

Your endpoint ID: <id>
Setting up tunnel...
Tunnel ready after 8 sec: https://<hostname>
Press Ctrl+C to stop...

^C
Disabling tunnel...
Tunnel disabled.

Building

# With Nix
nix run .#cli -- tunnel --help

# With Cargo
cargo run -p datum-connect -- tunnel --help

[zachsmith1]

Do we want a separate cli for tunnels or do we want to bake in functionality into datumctl?

[drewr]

Yeah, it's why this is a draft. I needed the functionality and didn't want to commit one way or the other yet. I explored doing it in datumctl and it would involve either replicating the Iroh sidecar in go or making the project hybrid with a rust component.

This method uses all the same machinery as the GUI which felt like a better first pass.

[zachsmith1]

Ya the challenge is the core stuff we need is in rust so we'll need some magic to make the UX good

[scotwells]

How does this interact with the GUI based application? Would auth be shared?

Since the GUI is locked to a specific project (because connectors are project-scoped resources), switching the authenticated user could break existing tunnels without the user knowing and it doesn't seem like we warn the user.

[drewr]

It's all shared. I'll show what it looks like when Rust is done compiling...