[joshk]

What

Adds nh CLI support for the two concepts introduced in nerves-hub/nerves_hub_web#2899:

• Org iroh endpoints — nh iroh-endpoint (alias iroh) with list / register / show / delete, managing an organization's registry of iroh endpoint ids, addressed by the endpoint id itself (not a row id).
• Device external identities — nh device external-identities <device> (alias identities), a read-only list of the keys a device reports holding on networks NervesHub does not run (iroh / NetBird / Tailscale / WireGuard), with --service and --instance filters.

Both honour -o json and the usual --org / --product scoping.

nh iroh-endpoint

• list — --owner device|user|none, --search <text>
• register <identifier> — --instance, --user-email, repeatable --detail key=value
• show <identifier>, delete <identifier> (with -y / confirmation)

API

internal/api/external_identity.go adds ExternalIdentity, IrohEndpoint, and IrohEndpointOwner types plus the request methods for:

• GET /orgs/:org/products/:product/devices/:identifier/external_identities
• GET /orgs/:org/iroh_endpoints
• POST /orgs/:org/iroh_endpoints
• GET /orgs/:org/iroh_endpoints/:identifier
• DELETE /orgs/:org/iroh_endpoints/:identifier

Server dependency

⚠️ These endpoints are added by nerves-hub/nerves_hub_web#2899, which is not yet merged — the commands will return 404 until it ships. This PR was built strictly against that PR's controllers and JSON views, and has not been exercised against a live server. Worth a manual smoke test once the server PR is deployed to staging.

Tests

11 new tests cover request paths/methods/query/body, table + JSON output, --owner and --detail validation, and delete confirm/abort. Full suite, go vet, and gofmt are green.

🤖 Generated with Claude Code