feat(cli): read config from stdin

[corylanou]

Description

Adds a -stdin config source for CLI commands that already read Litestream configuration. The shared config loader now reads from either -config, standard input, or the default config path, and rejects -config plus -stdin together.

Scope:

• In scope: databases, status, replicate, ltx, restore, and reset config loading.
• In scope: rejecting -stdin with direct replica URL/positional replica URL flows where -config is already invalid.
• Not in scope: changing the YAML config format or adding a persistent config path for stdin-loaded MCP tools.

Motivation and Context

Issue #1205 requests passing dynamically generated configuration through standard input so integrations do not need to create temporary config files that may contain credentials.

Fixes #1205

How Has This Been Tested?

• go test -run 'TestReadConfig|TestDatabasesCommand_Run/StdinJSONOutput' ./cmd/litestream
• go test ./cmd/litestream
• go build ./...
• go test ./...
• pre-commit run --all-files
• go test -race ./...
• golangci-lint run --new-from-rev=c30c5ffc364d6ee35b0b37d8ce4278371c8107a8

golangci-lint run without a diff base currently reports existing errcheck findings outside this change; the diff-scoped run reports 0 issues.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (would cause existing functionality to not work as expected)

Checklist

• My code follows the code style of this project (go fmt, go vet)
• I have tested my changes (go test ./...)
• I have updated the documentation accordingly (if needed)

[github-actions]

PR Build Metrics

✅ All clear — no issues detected

Check	Status	Summary
Binary size	✅	36.90 MB (+4.0 KB / +0.01%)
Dependencies	✅	No changes
Vulnerabilities	✅	None detected
Go toolchain	✅	1.25.11 (latest)
Module graph	✅	1240 edges (0)

Binary Size

	Size	Change
Base (c30c5ff)	36.89 MB
PR (e2fa1f6)	36.90 MB	+4.0 KB (+0.01%)

Dependency Changes

No dependency changes.

govulncheck Output

No vulnerabilities found.

Build Info

Metric	Value
Build time	44s
Go version	go1.25.11
Commit	e2fa1f6

---

_{🤖 Updated on each push.}

[akoutmos]

🤩 Really looking forward to this feature. Thank you so much for addressing #1205!

[benbjohnson]

Can you change this so that it uses -config - to read from STDIN rather than adding a -stdin flag? I tried looking around for other tools that read config from STDIN and that seems to be the convention:

• docker compose -f -
• caddy run --config -
• kubectl apply -f -