feat(sdk): operate-verb parity with the MCP server (vault, env-patch, presign, pause/resume, wake)

[mastermanas805]

What

Brings the Go SDK to operate-verb parity with the MCP server. MCP PR #41 shipped 9 operate tools; the SDK covered only 3 of the 11 operate-verb surfaces. This PR adds the missing 8 methods.

Every endpoint, payload, and response envelope was verified against the MCP client source (mcp/src/client.ts @ origin/master) and cross-checked against api/internal/handlers/openapi.go + the live handlers (vault.go, deploy.go UpdateEnv, deploy_wake.go, resource.go Pause/Resume, storage_presign.go, stack UpdateEnv) — no guessed endpoints.

Parity table

MCP operate tool	Endpoint	SDK before	SDK after
set_vault_key	PUT /api/v1/vault/:env/:key	missing	SetVaultKey ✅
rotate_vault_key	POST /api/v1/vault/:env/:key/rotate	missing	RotateVaultKey ✅
update_deploy_env	PATCH /deploy/:id/env	missing	UpdateDeployEnv ✅
update_stack_env	PATCH /stacks/:slug/env	missing	UpdateStackEnv ✅
presign_storage	POST /storage/:token/presign	missing	PresignStorage ✅
pause_resource	POST /api/v1/resources/:id/pause	missing	PauseResource ✅
resume_resource	POST /api/v1/resources/:id/resume	missing	ResumeResource ✅
rotate_credentials	POST /api/v1/resources/:id/rotate-credentials	RotateCredentials (pre-existing)	unchanged
wake_deployment	POST /deploy/:id/wake	missing	WakeDeployment ✅
get_capabilities	GET /api/v1/capabilities	Capabilities (#20)	unchanged
get_deployment_events	GET /api/v1/deployments/:id/events	DeploymentEvents (#22)	unchanged
backups list/trigger	n/a	n/a — MCP has no backup tools (audited src/index.ts @ origin/master)	n/a

Design notes

• Timeout class: all 8 new methods are quick mutations → 30 s read-path client. The 120 s provisioning deadline (fix(timeout): 120s provisioning deadline so slow provisions don't 409 #21) stays scoped to the synchronous /*/new + deploy/stack create endpoints.
• Error envelope: every method returns the full *APIError from fix(errors): full agent-native APIError envelope + Capabilities() + live prod integration test #20, so callers can branch on the 402 pause tier-gate (with upgrade_url/agent_action), 409 already_paused/not_paused/stack_deleting, 410 resource_inactive, and 501 scale_to_zero_disabled.
• Path safety: user-supplied path segments are url.PathEscape'd (a vault key containing / stays one segment — pinned by test).
• Auth: PresignStorage deliberately works without an API key — broker mode, the token in the URL is the credential (matches MCP, which marks it not-requireAuth).
• New putJSON / patchJSON client helpers reuse the existing retry + envelope core (doWithHeaders).
• Named constants for every path fragment; doc comments on every exported symbol.
• README method tables + CHANGELOG updated (also added the missing ProvisionStorage/ProvisionWebhook rows and pruned now-covered endpoints from the "not covered" list).

Tests / coverage

• httptest-based suites per method: wire method/path/body assertions, response decode, every validation branch, plus one APIError branch each.
• go test ./... -race -count=1 green locally.
• 100% statement coverage on every new function (go tool cover -func); instant package total 98.5% (≥95% floor). putJSON/patchJSON marshal-error branches pinned by direct internal tests so the diff-cover 100%-patch gate holds.

🤖 Generated with Claude Code