Fix self_hosted CLI routing gaps

[andrei-hasna]

Summary

• Route self_hosted-capable CLI paths through ConfigStore for session --config, apply, diff, explicit profile apply, snapshots list, templates, scan, and compare.
• Add explicit self_hosted gates before local-only sync, storage, profile membership/auto, snapshot-by-id, and maintenance commands can touch SQLite/PostgreSQL sync helpers.
• Pass cloud apply context through CLI and MCP apply flows so dry-runs do not initialize local SQLite.
• Add focused CLI and MCP self_hosted command-level regression coverage.

Validation

• staged_secret_scan=clean
• TMPDIR=/tmp TEMP=/tmp TMP=/tmp BUN_TMPDIR=/tmp BUN_INSTALL_CACHE_DIR=/tmp/bun-cache bun run typecheck
• TMPDIR=/tmp TEMP=/tmp TMP=/tmp BUN_TMPDIR=/tmp BUN_INSTALL_CACHE_DIR=/tmp/bun-cache bun test src/data/config-store.test.ts src/cli/cloud-mode.test.ts src/cli/session.test.ts src/cli/output.test.ts src/mcp/mcp.test.ts src/mcp/http.test.ts
• TMPDIR=/tmp TEMP=/tmp TMP=/tmp BUN_TMPDIR=/tmp BUN_INSTALL_CACHE_DIR=/tmp/bun-cache bun run build
• HASNA_INSTRUCTIONS_API_URL=https://instructions.invalid HASNA_INSTRUCTIONS_API_KEY=dummy bun run src/cli/index.tsx apply missing --dry-run exits 1 through cloud connectivity and does not print the local DB guard

Task: 6e8c4460-6af1-427f-bad0-cad593acc298
Source PR: #6

GitHub author is andrei-hasna
GitHub reviewer pool: andrei-hasna, kriptoburak
Selected non-author reviewer: kriptoburak

[andrei-hasna]

Closing this as stale/superseded rather than rejected on intent.

Evidence as of 2026-07-13: this PR head ff89914 is based on older main ancestry and conflicts with current main c9d5ec8 in package.json, src/cli/index.tsx, src/cli/storage.ts, src/lib/apply.ts, src/lib/sync.ts, and src/mcp/server.ts. The storage CLI file modified here has since been deleted on main.

Since this PR was opened, main has shipped the current Store/API architecture through @hasna/instructions v0.4.6, including later cloud-mode fixes. This PR targets the older v0.3.4-era shape, including store.mode === "cloud" and legacy storage surfaces, while current main uses the current API transport contract.

The July 7 CI success only applies to the stale PR head, not to a conflict-resolved branch against current main, and the PR has no reviews. Any remaining self_hosted/API-mode gap should be handled as a fresh branch from current main with focused tests against the current Store contract.