Add public API and migrate CLI

[arjunkomath]

Summary

• add the canonical /api/v1 public resource API with project/environment/service nesting, X-API-Key authentication, global role enforcement, pagination, configuration, deploy, status, logs, metrics, rollout, revision, and build-list endpoints
• migrate the Go CLI to the public API, persist links in techulus.yml, add current/active configuration handling and long-poll log following, and remove the old pre-alpha manifest/CLI endpoints
• make GitHub builds revision-first: resolve the exact commit before fan-out, snapshot source provenance and runtime artifact identity in an immutable service revision, build and deploy that revision, and create a fresh revision/artifact for retries
• harden build claim/status/workflow idempotency, cancellation races, migration/restore provenance, and deterministic Victoria Logs cursors
• keep API keys isolated from browser sessions and prevent API keys from minting additional keys; public projections omit secrets and internal GitHub authentication details
• fix the dashboard's false pending Image change for GitHub services by comparing repository, branch, and root directory rather than revision-scoped artifact tags
• harden outbound Docker Hub/GHCR validation with fixed origins, encoded URL components, redirect rejection, and validated bearer-token responses
• document the public API and add a CLI justfile for common build, test, run, formatting, and install tasks

The removed routes and schema changes intentionally do not preserve backward compatibility because the product and CLI are pre-alpha.

Architecture notes

• builds references service_revisions; repository and root-directory build inputs are not duplicated as mutable build snapshot columns
• successful manifests deploy the exact revision that reserved and produced the artifact
• rollouts reference one immutable revision, and agents read build/runtime inputs from that revision
• mutable current configuration remains separate from active revision configuration

Testing

• cd web && pnpm exec tsc --noEmit
• cd web && pnpm test — 41 files, 257 tests
• cd web && pnpm build
• cd agent && go test ./... && go vet ./...
• cd cli && just check
• cd cli && VERSION=local just build
• git diff --check
• final architecture and regression reviews approved with no blockers

Tasks

• https://app.basecamp.com/5890597/buckets/47439993/todos/10104404555
• https://app.basecamp.com/5890597/buckets/47439993/todos/10109634395

[github-actions]

React Doctor found no new issues. 🎉

_{Reviewed by React Doctor for commit 4ee1d6a.}

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
techulus-cloud	🟢 Ready	View Preview	Jul 21, 2026, 3:12 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.

[mintlify]

Preview deployment for your docs. Learn more about Mintlify Previews.

Project	Status	Preview	Updated (UTC)
techulus-cloud	🟡 Building	–	Jul 21, 2026, 3:12 AM

💡 Tip: Enable Workflows to automatically generate PRs for you.