feat(cli): add execution engine with context, auth, and execute commands

[pyramation]

feat(cli): add execution engine with context, auth, and execute commands

Summary

This PR adds a minimal execution engine to the cnc CLI that enables agents and users to make GraphQL requests against Constructive APIs. The implementation is intentionally simple to allow incremental feature additions later.

Config Management (src/config/):

• Uses appstash for standardized config storage at ~/.cnc/
• Context configs store name and endpoint URL directly (similar to kubectl contexts)
• Credentials stored separately with 0o600 file permissions

New Commands:

• cnc context create|list|use|current|delete - Manage context configurations
• cnc auth set-token|status|logout - Manage API tokens per context (with password masking)
• cnc execute - Execute raw GraphQL queries/mutations

SDK Client (src/sdk/):

• Simple GraphQL client using native fetch - no external dependencies
• Supports raw query strings with variables
• Returns structured QueryResult<T> with ok/data/errors

Updates since last revision

• Renamed "project" to "context" throughout the CLI to align with kubectl's context model:
  • cnc project → cnc context
  • --project flag → --context flag
  • ProjectConfig → ContextConfig, ProjectCredentials → ContextCredentials
  • Config storage moved from ~/.cnc/config/projects/ to ~/.cnc/config/contexts/
  • Subcommand changes: init → create, info → current
• This avoids confusion with Constructive database "projects" and follows established CLI patterns (kubectl, docker context)
• Fixed stale usage text in display.ts - removed old --model/--action examples that no longer exist, updated to show simplified --query syntax

Review & Testing Checklist for Human

• Test the context flow end-to-end:

  cnc context create my-api --endpoint https://api.example.com/graphql
  cnc auth set-token  # Should mask input with asterisks
  cnc execute --query 'query { __typename }'

• Verify credential storage security - Check that ~/.cnc/config/credentials.json is created with mode 0o600 (owner read/write only).
• Test context switching - Create multiple contexts and verify cnc context use and cnc context current work correctly.
• Verify cnc --help output - Confirm the usage text shows the correct simplified examples (no --model/--action flags).

Recommended Test Plan:

1. Install the CLI locally and run cnc context create with a real endpoint URL
2. Set a real API token with cnc auth set-token and verify input is masked
3. Try cnc execute --query '...' against a real GraphQL API
4. Check ~/.cnc/config/ to verify file structure (contexts/ directory, not projects/)
5. Run cnc --help and verify examples are correct

Notes

• No automated tests are included for the new functionality - manual testing is required
• OAuth login flow is not implemented - only manual token setting via cnc auth set-token
• This is intentionally minimal - features like model-to-API routing and query builders can be added incrementally
• Password masking depends on inquirerer password type from dev-utils PR modules #58

Link to Devin run: https://app.devin.ai/sessions/041b1d6074a549febda2c95195f1e758
Continued in: https://app.devin.ai/sessions/3db8ac553a7641ee811f8da59592f68a
Requested by: Dan Lynch (@pyramation)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring