feat(cli): complete Phase 04 subcommand surface

[KeyCode17]

Summary

Fills the gaps in px-cli that the Phase 04 plan (docs/phase/04-cli-canary-docs.md) tracks, and refactors px-cli into module-per-command so each file stays well below the 200-LOC axum-best-practice rule.

New / restored subcommands:

• allowlist add --handler cloudflare — ADR-0023 explicit follow-up. Operator can mark a target as CF-fronted via YAML without the deprecated PX_CAMOUFOX_DOMAINS env CSV.
• allowlist remove --domain ... — was missing entirely; the phase plan lists {add,remove,list}.
• allowlist list now also prints the resolved handler column.
• keys generate --write — append the generated id/argon2_hash to config/keys.yaml (with duplicate-id guard).
• detect --url ... — fetch the URL with a stealth-ish UA before running the regex detector. Non-server errors keep the response body so PX block pages still surface Detected::Yes.
• solve <url> — call POST /v1/solve on a running px-server with a Bearer id:secret token (env PX_SERVER_URL / PX_API_KEY supported).

Workspace touch:

• Adds reqwest (rustls, gzip, json) + serde_json to [workspace.dependencies].
• Adds the env feature to the shared clap declaration so CLI args can fall back to env vars.

Why

The Phase 04 deliverable list explicitly expects all five subcommands; solve and serve were stubs that printed "this is a stub" messages, and allowlist remove plus --handler were never wired even though ADR-0023 marked them as follow-ups. With this PR, px-cli is operator-usable end-to-end against a running px-server.

Test plan

• cargo build -p px-cli
• cargo fmt --all -- --check
• cargo clippy --workspace --all-targets --all-features against the lefthook rule set
• Lefthook pre-commit + pre-push hooks pass locally (fmt, clippy, loc≤200, forbidden-patterns, tests)
• px-cli allowlist add (with + without --handler), remove, list against a temp YAML — round-trip OK, duplicate-domain + missing-domain errors are precise
• px-cli keys generate --write against a temp YAML — first call writes, second call rejects the duplicate id
• px-cli detect --url https://www.pedidosya.com.ar — returns a clean diagnostic when the upstream is PX-blocked
• px-cli --help — subcommands and -h text render correctly

Notes for the reviewer

• This is intentionally bundled into one PR because all five changes touch the same px-cli crate boundary and the module split is the load-bearing change; splitting would force three independent rewrites of main.rs.
• The reqwest features are pinned to rustls-tls to keep openssl out of the build graph; happy to swap if there's a preferred TLS stack.

🤖 Generated with Claude Code