Plan: Canopy CLI

tools/canopy-cli/
├── Cargo.toml
├── src/
│   ├── main.rs              # clap parse + command dispatch
│   ├── lib.rs               # pub exports for integration tests
│   ├── client.rs            # ApiClient (reqwest + bearer auth)
│   ├── output.rs            # Format enum, print_list, print_detail, check_status
│   ├── config.rs            # Profile, profiles.toml, config_dir
│   ├── auth.rs              # Keycloak ROPC login, token storage, refresh
│   └── cmd/
│       ├── mod.rs
│       ├── login.rs          # canopy login
│       ├── token.rs          # canopy token show|refresh
│       ├── completion.rs     # canopy completion <shell>
│       ├── person.rs         # canopy person create|list|get|update|delete
│       ├── household.rs      # canopy household create|get|add-member|remove-member
│       ├── rules.rs          # canopy rules list|get|create|update|delete|import|evaluate
│       ├── application.rs    # canopy application create|list|get|update|withdraw
│       ├── eligibility.rs    # canopy eligibility determine|get|list
│       └── security.rs       # canopy security events|alerts|nist-controls
└── tests/
    └── cli_test.rs

# ~/.config/canopy/profiles.toml

[default]
keycloak_url = "http://localhost:8180"
keycloak_realm = "canopy"
keycloak_client_id = "canopy-api"
persons_url = "http://localhost:8002"
applications_url = "http://localhost:8003"
eligibility_url = "http://localhost:8004"
rules_url = "http://localhost:8001"
security_url = "http://localhost:8012"
web_url = "http://localhost:8080"

// SPDX-License-Identifier: AGPL-3.0-or-later

pub struct ApiClient {
    client: reqwest::Client,
    base_url: String,
    token: String,
}

impl ApiClient {
    pub fn new(base_url: &str, token: &str) -> Self { ... }
    pub async fn get(&self, path: &str) -> Result<(StatusCode, Value)> { ... }
    pub async fn get_with_query<Q: Serialize>(&self, path: &str, query: &Q) -> Result<(StatusCode, Value)> { ... }
    pub async fn post<B: Serialize>(&self, path: &str, body: &B) -> Result<(StatusCode, Value)> { ... }
    pub async fn put<B: Serialize>(&self, path: &str, body: &B) -> Result<(StatusCode, Value)> { ... }
    pub async fn delete(&self, path: &str) -> Result<(StatusCode, Value)> { ... }
}

#[derive(Clone, Copy, Debug, clap::ValueEnum)]
pub enum Format {
    Table,
    Json,
}

pub fn check_status(status: StatusCode, body: &Value) -> Result<()> { ... }
pub fn print_list(format: Format, body: &Value, columns: &[&str]) -> Result<()> { ... }
pub fn print_detail(format: Format, body: &Value) -> Result<()> { ... }