feat: meta-gov-env CLI — org environments, cloud accounts, env types

[fhacloid]

Summary

Org-scoped environment governance for the meta-gov-env API:

• cy environment — org CRUD (create, get, list, update, delete), project link/unlink, PATCH semantics (only flags you pass are sent; fetch current state to preserve links/variables)
• cy cloud-account — org CRUD; inline credential on create and update (--new-credential or --credential); create --update upsert
• cy environment-type — org CRUD with required --color
• Upsert everywhere — create --update and update both create-or-update (no 404 on missing env)
• --color on environments — deprecated; emits warning only, does not error
• delete --project — removed; use unlink then org-level delete

Migration note: auto-link → explicit link

Previously cy env create --project X created and linked in one step. Environments are now org entities first; project association is a separate relation:

cy env create --env prod --name Production
cy env link --project my-app --env prod

Scripts must add an explicit link after create (or use Terraform/provider which handles both steps).

Env scope: org vs project

Layer	API	CLI
Org	CRUD on /organizations/{org}/environments/{env}	cy env create/get/list/update/delete
Project link	POST/DELETE /projects/{p}/environments	cy env link/unlink, cy env list --project
Project view	GET /projects/{p}/environments → ProjectEnvironment (+ components)	list with --project

The CLI middleware no longer exposes project-scoped env CRUD (CreateEnv, UpdateEnv, DeleteEnv on project routes). All mutations go through org endpoints; project commands only manage the link.

Backend caveats

• type still sent as "production" fallback until Lukasz lands optional-type inference (TODO(meta-gov-env) in code)
• Explicit empty arrays (--cloud-account "") wipe links; omitting the flag preserves current links

Test plan

• go build ./...
• go test ./cmd/cycloid/middleware/...
• go test ./e2e/ -run TestEnvs (create, link, get, create --update, update upsert, explicit empty cloud-account, delete)
• Full ./e2e/ against staging backend
• Manual: cloud-account create/update with --new-credential
• Terraform provider pre-shot: feat(provider): org-scoped environment resource (meta-gov-env pre-shot) terraform-provider-cycloid#101 (branch fix/env-canonical-api-drift, not for merge until this is validated)

[locycloid]

The code looks good, but I got two questions

1. I suppose we don't need finops operations for the CLI ?
2. I see almost no tests - at least unit ones would be nice

[fhacloid]

@lukasz we'll add finops if customer ask for it. For the test, good point, will ad them.

[fhacloid]

Status update

PR updated and tested following Lukasz's review.

Changes since initial review

Critical fix — --update upsert now works for environment-type
GetEnvironmentType previously returned a plain fmt.Errorf on miss; the stderrors.As check in the upsert path always failed, so cy environment-type create --update would error instead of creating. Now returns *APIResponseError{StatusCode: 404} so the upsert path works correctly.

Security — debug logger no longer leaks credentials
--verbosity=debug was logging raw request/response bodies before sanitization. Both logRequest and logResponse in debug.go now pass bodies through sanitizeBody() first. Audit also confirms the error path in generic_client.go already sanitized correctly — only the debug path was affected.

Other fixes

• Pagination capped at 1000 pages (guard against infinite loop on buggy backends)
• LinkEnvToProject returns nil, nil on idempotent no-op instead of synthetic http.Response
• All MarkFlagRequired return values now captured (_ =)
• environments --color replaced custom warnDeprecatedColor with cobra MarkDeprecated
• cloudaccounts/update mutual-exclusion error returns directly (consistent with create)
• cloudaccounts/delete logs per-canonical on success so partial failures are visible
• ptrValue helper removed from both packages, replaced with ptr.Value
• Test: require.NotNil(resp) guard before .StatusCode deref in NotFound test