Add the mred CLI over the library, with flags accepted after positionals

issue list/show/create/update, version list/create, category
list/create, relation create. Names resolve case-insensitively against
server enumerations; -o json everywhere; exit 0/1/2 with one-line
stderr carrying the http status for API failures.

internal/cli/cli.go

@@ -0,0 +1,149 @@
+// Package cli implements the mred command line: a thin, machine-friendly
+// front end over the redmine library. Connection settings come from
+// MRED_URL / MRED_KEY env vars or a 0600 --config env file — the API key
+// is never a flag value and never logged. Every command accepts -o json
+// for machine output. Exit codes: 0 ok, 1 usage/config, 2 API error
+// (single-line stderr carrying the http status, parseable).
+package cli
+
+import (
+	"flag"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"git.knownelement.com/ukrrs/mopac-redmine-go/internal/config"
+	"git.knownelement.com/ukrrs/mopac-redmine-go/redmine"
+)
+
+const usage = `mred: Redmine CLI (stdlib-only, library-backed)
+
+Usage:
+  mred issue list -p PROJECT [--status open|all|closed|NAME] [--version NAME] [--limit N] [-o json]
+  mred issue show ID [--with journals] [-o json]
+  mred issue create -p PROJECT -s SUBJECT [--desc FILE|-] [--tracker NAME]
+                    [--priority NAME] [--category NAME] [--version NAME]
+                    [--due DATE] [--parent ID] [--est HOURS] [--note TEXT] [-o json]
+  mred issue update ID [--status NAME] [--priority NAME] [--category NAME]
+                    [--version NAME] [--due DATE] [--done-ratio N]
+                    [--desc FILE|-] [--note TEXT] [-o json]
+  mred version list -p PROJECT [-o json]
+  mred version create -p PROJECT -n NAME [--due DATE] [--status open|closed] [-o json]
+  mred category list -p PROJECT [-o json]
+  mred category create -p PROJECT -n NAME [-o json]
+  mred relation create FROM TO --type blocks|relates [-o json]
+  mred help
+
+Connection: MRED_URL + MRED_KEY env vars, or --config PATH pointing at a
+0600 env file with the same keys. The API key never appears in flags,
+logs, or error output.
+
+Names (--tracker feature, --priority immediate, --status done, --category
+and --version) are resolved case-insensitively against the server's own
+enumerations; issue ids are numeric.
+
+Exit codes: 0 ok, 1 usage/config error, 2 API error (stderr: one line,
+"http NNN" included).`
+
+// Run executes one command; it returns the process exit code.
+func Run(args []string, stdout, stderr io.Writer) int {
+	if len(args) == 0 {
+		fmt.Fprint(stderr, usage)
+		return 1
+	}
+	switch args[0] {
+	case "help", "-h", "--help":
+		fmt.Fprint(stdout, usage)
+		return 0
+	case "issue":
+		return cmdIssue(args[1:], stdout, stderr)
+	case "version":
+		return cmdVersion(args[1:], stdout, stderr)
+	case "category":
+		return cmdCategory(args[1:], stdout, stderr)
+	case "relation":
+		return cmdRelation(args[1:], stdout, stderr)
+	default:
+		fmt.Fprintf(stderr, "mred: unknown command %q\n\n%s\n", args[0], usage)
+		return 1
+	}
+}
+
+// newFlags builds a quiet flag set with the shared --config and -o flags.
+func newFlags(name string, stderr io.Writer) (*flag.FlagSet, *string, *string) {
+	fs := flag.NewFlagSet(name, flag.ContinueOnError)
+	fs.SetOutput(io.Discard)
+	cfg := fs.String("config", "", "env file with MRED_URL/MRED_KEY (must be 0600)")
+	out := fs.String("o", "text", "output format: text|json")
+	return fs, cfg, out
+}
+
+// parseArgs parses flags that may appear AFTER positionals (the standard
+// flag package stops at the first positional; mred's documented surface
+// is "issue update ID --note X", "relation create FROM TO --type blocks").
+// It returns the positional arguments.
+func parseArgs(fs *flag.FlagSet, args []string) ([]string, error) {
+	var positionals []string
+	rest := args
+	for {
+		if err := fs.Parse(rest); err != nil {
+			return nil, err
+		}
+		got := fs.Args()
+		i := 0
+		for i < len(got) && (got[i] == "-" || !strings.HasPrefix(got[i], "-")) {
+			i++
+		}
+		positionals = append(positionals, got[:i]...)
+		if i == len(got) {
+			return positionals, nil
+		}
+		rest = got[i:]
+	}
+}
+
+// client resolves config (env + optional 0600 file) and builds the client.
+// A nil client and non-nil error means exit 1; API failures surface later
+// as exit 2.
+func client(cfgPath string) (*redmine.Client, error) {
+	if cfgPath == "" {
+		cfgPath = os.Getenv("MRED_CONFIG")
+	}
+	if cfgPath == "" {
+		if home, err := os.UserHomeDir(); err == nil {
+			cand := filepath.Join(home, ".config", "mred", "env")
+			if _, err := os.Stat(cand); err == nil {
+				cfgPath = cand
+			}
+		}
+	}
+	cfg, _, err := config.Load(cfgPath)
+	if err != nil {
+		return nil, err
+	}
+	return redmine.New(redmine.Config{BaseURL: cfg.BaseURL, APIKey: cfg.APIKey}), nil
+}
+
+// apiErr reports an API failure the mred way: one line, exit 2.
+func apiErr(stderr io.Writer, err error) int {
+	fmt.Fprintf(stderr, "mred: %v\n", err)
+	return 2
+}
+
+// usageErr reports a usage/config failure: one line, exit 1.
+func usageErr(stderr io.Writer, format string, args ...any) int {
+	fmt.Fprintf(stderr, "mred: "+format+"\n", args...)
+	return 1
+}
+
+// emitJSON pretty-prints v for -o json.
+func emitJSON(stdout io.Writer, v any) {
+	b, err := marshalIndent(v)
+	if err != nil {
+		return // library types are JSON-clean by construction
+	}
+	stdout.Write(b)
+	fmt.Fprintln(stdout)
+}