GOBL Net: port CLI + ops from invopop/gobl@net

[samlown]

Summary

Brings the CLI half of the GOBL Net effort across from
invopop/gobl@net (PR
#785, where the library half lives) into this repo, now that
cmd/gobl/, internal/ops/, internal/mcp/, pkg/api/, and
wasm/ live here.

The gobl module is pinned to ff04d20e7388 — the post-merge tip of
the net branch in gobl after cli-to-gobldev was merged in.

New commands

• gobl init <domain> — scaffold ~/.config/gobl/<domain>/ (ES256
  keypair + party.json template with a pre-filled gobl:<domain>
  endpoint).
• gobl net who <address> --from <domain> — authenticated mutual
  party exchange; returns the target's verified org.Party
  envelope.
• gobl net send <envelope> --to <domain> --from <domain> — deliver
  a signed envelope to a remote /inbox.
• gobl net serve — HTTPS server with
  /.well-known/gobl/keys/<kid> (per-key lookup),
  /.well-known/jwks.json (bulk JWK Set sorted by valid_from
  desc), /who, and /inbox. Multi-tenant. ACME. Open CORS for
  browser-based JOSE tooling. Optional allow.json gate.

Extended commands

• gobl sign --domain X [--to Y] stamps
  iss=gobl:X / aud=gobl:Y into the signed payload.
• gobl verify gains --address / --remote for remote key
  discovery.
• gobl keygen is deprecated in favour of gobl init.

Operator output

• --json flag toggles all operator-facing log output between
  text (default) and JSON via log/slog. Logs go to stderr; result
  output (signed envelopes, /who party JSON, version JSON) stays on
  stdout. slog is set up in PersistentPreRunE on the root
  command (not cobra.OnInitialize, which would race in parallel
  tests).
• Structured HTTP access logs (http_request, keys.lookup,
  jwks.served, who.exchange / who.rejected,
  inbox.accepted / inbox.rejected, inbox.write_failed) plus
  structured startup messages.

On-disk layout

<config>/<domain>/{private.jwk, keys/<kid>.json, party.json, allow.json, inbox/} — one file per kid (filename equals kid,
validated at startup). Maps 1-to-1 to a future row-per-kid
database.

Security

/inbox re-parses the document UUID with uuid.Parse before
writing to disk, as a defence-in-depth check against path
traversal (alongside the existing strict 36-char format check from
google/uuid).

Test plan

• go build ./... clean.
• go vet ./... clean.
• go test -race ./... green across api, cmd/gobl,
  internal/mcp, internal/ops, wasm.
• golangci-lint run ./... clean.
• End-to-end smoke: gobl init smoke.example (UUIDv7 kid),
  followed by gobl sign --domain alice.example --to bob.example
  → signed payload {uuid, dig, iss=gobl:alice.example, aud=gobl:bob.example, iat=<unix>}.

🤖 Generated with Claude Code

[codecov-commenter]

Codecov Report

❌ Patch coverage is 86.35394% with 128 lines in your changes missing coverage. Please review.
✅ Project coverage is 77.95%. Comparing base (777724c) to head (812fc38).
⚠️ Report is 5 commits behind head on cli-trial.

Files with missing lines	Patch %	Lines
internal/ops/net_serve.go	86.04%	46 Missing and 26 partials ⚠️
internal/ops/net_who.go	80.82%	7 Missing and 7 partials ⚠️
cmd/gobl/net_who.go	70.45%	13 Missing ⚠️
cmd/gobl/main.go	41.17%	9 Missing and 1 partial ⚠️
cmd/gobl/net_serve.go	90.14%	4 Missing and 3 partials ⚠️
cmd/gobl/root.go	42.85%	3 Missing and 1 partial ⚠️
internal/ops/net_init.go	84.61%	2 Missing and 2 partials ⚠️
internal/ops/net_send.go	88.57%	2 Missing and 2 partials ⚠️

Additional details and impacted files

@@              Coverage Diff              @@
##           cli-trial       #2      +/-   ##
=============================================
+ Coverage      72.71%   77.95%   +5.23%     
=============================================
  Files             47       57      +10     
  Lines           1983     2908     +925     
=============================================
+ Hits            1442     2267     +825     
- Misses           463      527      +64     
- Partials          78      114      +36     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.