fix(client): send Ory-RateLimit-Action header on project HTTP client

The ORY_RATE_LIMIT_HEADER value was only attached to the Ory Network SDK
client, not to the project HTTP client used by the wrapped Ory Kratos and
Ory Hydra admin CLI commands (identity import/get/list, etc.). As a result
those admin API calls were still subject to rate limiting during E2E tests.

Attach the header to the project HTTP client too. No-op unless the env var
is set.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: alnr

cmd/cloudx/client/http_client.go

@@ -19,3 +19,18 @@ func newOAuth2TokenClient(token oauth2.TokenSource) *http.Client {
 		Timeout: time.Second * 30,
 	}
 }
+
+// setHeaderTransport sets a fixed header on every outgoing request. It is used
+// to attach the Ory-RateLimit-Action header (see ORY_RATE_LIMIT_HEADER) to the
+// project HTTP client so that admin API calls issued by the wrapped Ory Kratos
+// and Ory Hydra CLI commands are not rate limited during E2E tests.
+type setHeaderTransport struct {
+	base       http.RoundTripper
+	key, value string
+}
+
+func (t *setHeaderTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	req = req.Clone(req.Context())
+	req.Header.Set(t.key, t.value)
+	return t.base.RoundTrip(req)
+}

cmd/cloudx/client/sdks.go

@@ -125,6 +125,9 @@ func (h *CommandHelper) newProjectHTTPClient(ctx context.Context) (*http.Client,
 		Base:   c.Transport,
 		Source: tokenSource,
 	}
+	if rateLimitHeader != "" {
+		c.Transport = &setHeaderTransport{base: c.Transport, key: "Ory-RateLimit-Action", value: rateLimitHeader}
+	}
 
 	return c, baseURL, nil
 }