feat(cli): v2 — full API coverage, profiles, --json/--yes, containr up

Rewrite the CLI as a thin client over the authenticated API so agents
and scripts reach every resource the UI does (ROADMAP2 phase A2).

- shared Client with bearer auth, error-envelope decoding, and stable
  exit codes: 0 ok / 1 error / 2 auth / 3 not-found / 4 validation /
  5 unreachable
- named profiles in ~/.containr.yaml (current_profile + profiles.*);
  resolution order --flag > env > profile > localhost default;
  CONTAINR_TOKEN / CONTAINR_API_URL / CONTAINR_PROFILE env support
- --json prints raw API responses; --yes skips confirmations;
  destructive commands refuse non-interactively without it
- auth login verifies the token against /user/profile before saving,
  interactive prompt via term.ReadPassword
- commands for every resource: tokens, projects, services, deploy,
  deployments (logs/rollback), logs --follow (SSE), exec, variables
  (set/unset merge with secret masking preserved), databases
  (backup/restore/download), cron, templates, nodes + agent tokens,
  scaling, ha, security, gateway, admin, notifications
- containr up: git remote + branch → create-or-reuse service → deploy

Verified live: login/status/tokens/projects/services, up creating a
service + deployment, non-TTY confirmation refusal, scope-capped admin
rejection (exit 2), revoke.

Authored By: TDvorak <[email protected]>

app/backend/internal/cli/commands/deploy.go

@@ -0,0 +1,135 @@
+package commands
+
+import (
+	"fmt"
+
+	"github.com/spf13/cobra"
+)
+
+// DeployCmd triggers a deployment for a service.
+var DeployCmd = &cobra.Command{
+	Use:   "deploy <service-id>",
+	Short: "Trigger a deployment",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		body := map[string]interface{}{"trigger": "cli"}
+		for _, f := range []string{"commit-hash", "branch"} {
+			if v, _ := cmd.Flags().GetString(f); v != "" {
+				key := "commit_hash"
+				if f == "branch" {
+					key = "branch"
+				}
+				body[key] = v
+			}
+		}
+		data, err := c.Do("POST", "/services/"+args[0]+"/deployments", body)
+		if err != nil {
+			return err
+		}
+		if JSONMode() {
+			PrintRaw(data)
+			return nil
+		}
+		d, _ := unwrapObject(data, "deployment")
+		fmt.Printf("Deployment %s started for service %s (status: %s)\n",
+			str(d, "id"), args[0], str(d, "status"))
+		fmt.Println("Follow with: containr deployments logs " + str(d, "id"))
+		return nil
+	},
+}
+
+// DeploymentsCmd manages deployment history.
+var DeploymentsCmd = &cobra.Command{
+	Use:     "deployments",
+	Aliases: []string{"deployment"},
+	Short:   "Inspect deployments",
+}
+
+var deploymentsListCmd = &cobra.Command{
+	Use:   "list [service-id]",
+	Short: "List deployments (all recent, or for one service)",
+	Args:  cobra.MaximumNArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		path := "/deployments"
+		if len(args) > 0 {
+			path = "/services/" + args[0] + "/deployments"
+		}
+		data, err := c.Do("GET", path, nil)
+		if err != nil {
+			return err
+		}
+		items, err := unwrapList(data, "deployments")
+		if err != nil {
+			return err
+		}
+		rows := make([][]string, 0, len(items))
+		for _, d := range items {
+			rows = append(rows, []string{
+				str(d, "id"), str(d, "service_id"), str(d, "status"), str(d, "trigger"), relTime(d, "created_at", "started_at"),
+			})
+		}
+		printRows(data, []string{"ID", "SERVICE", "STATUS", "TRIGGER", "STARTED"}, rows)
+		return nil
+	},
+}
+
+var deploymentsGetCmd = &cobra.Command{
+	Use:   "get <id>",
+	Short: "Show a deployment",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("GET", "/deployments/"+args[0], nil)
+		if err != nil {
+			return err
+		}
+		PrintRaw(data)
+		return nil
+	},
+}
+
+var deploymentsLogsCmd = &cobra.Command{
+	Use:   "logs <id>",
+	Short: "Stream a deployment's build/deploy logs",
+	Args:  cobra.ExactArgs(1),
+	RunE:  runDeploymentLogs,
+}
+
+var deploymentsRollbackCmd = &cobra.Command{
+	Use:   "rollback <id>",
+	Short: "Roll back to a deployment",
+	Args:  cobra.ExactArgs(1),
+	RunE: func(cmd *cobra.Command, args []string) error {
+		c, err := client()
+		if err != nil {
+			return err
+		}
+		data, err := c.Do("POST", "/deployments/"+args[0]+"/rollback", map[string]interface{}{})
+		if err != nil {
+			return err
+		}
+		if JSONMode() {
+			PrintRaw(data)
+			return nil
+		}
+		fmt.Printf("Rolled back to deployment %s\n", args[0])
+		return nil
+	},
+}
+
+func init() {
+	DeployCmd.Flags().String("commit-hash", "", "commit to deploy")
+	DeployCmd.Flags().String("branch", "", "branch to deploy")
+	DeploymentsCmd.AddCommand(deploymentsListCmd, deploymentsGetCmd, deploymentsLogsCmd, deploymentsRollbackCmd)
+}