Implement full Restium declarative REST client

[mikkeldamsgaard]

Summary

• Complete implementation of Restium across 4 epics (19 stories): CLI foundation, secure API connectivity (5 auth types), resource reconciliation with dependency graphs, and production deployment
• 169 tests, clippy clean, fmt clean
• Code review fixes applied to Epic 4: sidecar spurious wakeup safety, hardened CI/CD pipelines, corrected Helm templates, improved documentation

What's included

Epic 1: Declarative Spec & CLI Foundation

• CLI with clap derive, reconcile and validate subcommands
• Structured JSON/text logging with automatic secret redaction
• YAML spec parsing with global settings and resource definitions
• Spec validation: reference checking, duplicate detection, cycle detection

Epic 2: Secure API Connectivity

• HTTP client with TLS (rustls), custom CA bundles, --insecure-tls
• 5 auth providers: bearer token, basic auth, API key (header/query), OIDC client credentials, mTLS
• Per-resource auth override

Epic 3: Resource Reconciliation

• Dependency graph with petgraph topological sort
• State discovery via GET, key-order-independent JSON diff
• Create/update/delete operations with actionable error messages
• Output extraction and ${resource.output.field} reference resolution
• Reconcile orchestration with summary reporting

Epic 4: Production Deployment

• --sidecar mode for K8s sidecar containers
• Distroless Docker image (FROM scratch, 3.5MB, non-root)
• CI/CD: lint+test+build on PR, release pipeline with cargo publish + multi-arch GHCR
• README, example specs, Helm chart

Test plan

• make lint — clippy --all-targets + fmt --check
• make test — 169 tests pass (unit + e2e)
• cargo build --release — produces binary
• CI pipeline runs successfully on this PR

🤖 Generated with Claude Code