feat: add the kettle CLI, replacing the plugin's Python scripts

The plugin resolved its issue store from `__file__`, which put it inside a
versioned plugin cache: issues written from one project were invisible from the
next, and `origin: local` files — the only copy of that work by definition —
were stranded a version bump at a time. The walk that answers "which directory
is the project" was written three times over, and in a linked worktree the three
disagreed. Both are runtime failures rather than logic ones, so the fix is a
compiled binary: one walk, imported rather than re-derived, and a layering rule
the build graph enforces instead of a grep.

Seven packages, knowledge flowing one way. `project` answers which directory is
the project and depends on nothing. `issue` is the domain — format, taxonomy,
validation, checkboxes, dependency graph, the store, eviction — offline, with no
tracker in it. `wire` holds the protocol shapes. `gitea` is the transport,
`mapping` the bridge, `config` the credentials, `cmd` the command tree. Four
tests hold the boundaries, each failing on a real mistake rather than a naming
convention.

The marker moves to `.kettle/` and the login pin moves out of the harness's
settings file into `.kettle/config.yaml`, which pins a login by NAME; the tokens
live in one file per machine, mode 0600, outside every working tree. That
retires the PreToolUse guard hook entirely — the binary holds its own
credentials, so a command running under a login nobody chose is not expressible
rather than caught.

`kettle init` migrates an older `tmp/issues` or `.tea/issues` store in, as a
move: a store left behind at an old path is one somebody edits by accident
months later.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

cli/internal/cmd/auth.go

@@ -0,0 +1,140 @@
+package cmd
+
+import (
+	"bufio"
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"strings"
+
+	"git.noodles.cam/claude-skills/marketplace/cli/internal/config"
+)
+
+func init() {
+	register(&Command{
+		Name:  "auth",
+		Group: GroupProject,
+		Args:  "list | add | remove <name>",
+		Short: "manage the tokens this machine holds",
+		Long: `Credentials live in one file per machine, outside every working tree, mode
+0600. A project pins a login by NAME; the name is worth nothing on its own,
+which is what makes it safe to keep in a file inside the repository.
+
+The token is read from standard input unless --token is given, because an
+argument is in the shell history the moment it is typed:
+
+    kettle auth add --name noodles --url https://git.example.com < token.txt
+    pass show gitea/token | kettle auth add --name noodles --url https://git.example.com
+
+` + "`list`" + ` never prints a token. There is no flag to make it.`,
+		Examples: []Example{
+			{"kettle auth list", "what this machine holds"},
+			{"pass show gitea | kettle auth add --name noodles --url https://git.example.com", "add one, token on stdin"},
+			{"kettle auth remove noodles", "forget it"},
+		},
+		Setup: func(fs *flag.FlagSet) func([]string) error {
+			name := fs.String("name", "", "login name (add)")
+			url := fs.String("url", "", "instance URL, e.g. https://git.example.com (add)")
+			user := fs.String("user", "", "account this token belongs to; documentation only (add)")
+			token := fs.String("token", "", "token, if you would rather not use stdin (add)")
+
+			return func(args []string) error {
+				verb := "list"
+				if len(args) > 0 {
+					verb = args[0]
+				}
+				logins, err := config.LoadLogins()
+				if err != nil {
+					return err
+				}
+
+				switch verb {
+				case "list":
+					if len(logins.Logins) == 0 {
+						fmt.Printf("no logins in %s\n", config.LoginsPath())
+						return nil
+					}
+					fmt.Printf("%s\n\n", config.LoginsPath())
+					for _, l := range logins.Logins {
+						who := l.User
+						if who == "" {
+							who = "—"
+						}
+						fmt.Printf("  %-16s %-40s %s\n", l.Name, l.URL, who)
+					}
+					return nil
+
+				case "add":
+					if *name == "" || *url == "" {
+						return Fail("--name and --url are both required")
+					}
+					secret := *token
+					if secret == "" {
+						if secret, err = readToken(os.Stdin); err != nil {
+							return err
+						}
+					}
+					if secret == "" {
+						return Fail("no token — pipe one in, or pass --token")
+					}
+					entry := config.Login{
+						Name:  *name,
+						URL:   strings.TrimRight(*url, "/"),
+						User:  *user,
+						Token: secret,
+					}
+					if existing := logins.Find(*name); existing != nil {
+						*existing = entry
+					} else {
+						logins.Logins = append(logins.Logins, entry)
+					}
+					if err := config.SaveLogins(logins); err != nil {
+						return err
+					}
+					fmt.Printf("%s -> %s   %s\n", entry.Name, entry.URL, config.LoginsPath())
+					return nil
+
+				case "remove":
+					if len(args) != 2 {
+						return Fail("give exactly one login name to remove")
+					}
+					target := args[1]
+					kept := logins.Logins[:0]
+					found := false
+					for _, l := range logins.Logins {
+						if l.Name == target {
+							found = true
+							continue
+						}
+						kept = append(kept, l)
+					}
+					if !found {
+						return Fail("no login %q in %s", target, config.LoginsPath())
+					}
+					logins.Logins = kept
+					if err := config.SaveLogins(logins); err != nil {
+						return err
+					}
+					fmt.Printf("removed %s\n", target)
+					return nil
+				}
+				return Fail("unknown subcommand %q — list, add, or remove", verb)
+			}
+		},
+	})
+}
+
+// readToken takes the first non-empty line of r, trimmed.
+//
+// The first line, not the whole stream: a token piped from a password manager
+// often arrives with a trailing newline and sometimes with notes underneath it.
+func readToken(r io.Reader) (string, error) {
+	sc := bufio.NewScanner(r)
+	for sc.Scan() {
+		if line := strings.TrimSpace(sc.Text()); line != "" {
+			return line, nil
+		}
+	}
+	return "", sc.Err()
+}