Initial release: self-hostable APT repository server and CLI

urapt is a self-hostable APT repository server with a companion CLI for
pushing and managing Debian .deb packages.

Server (urapt-server):
- REST API + APT endpoint, SQLite storage (pure-Go modernc driver, no CGO)
- .deb files stored content-addressed on disk, reference-counted for dedup
- Server-managed RSA-4096 OpenPGP signing key (ProtonMail/go-crypto)
- APT indices (Release/InRelease/Packages[.gz/.xz]) generated on demand
  from the DB, cached in memory, signed with the server key
- Full APT model: repositories -> distributions -> components -> architectures
- Bearer-token auth for REST; HTTP Basic auth for private-repo APT reads
- First registrant becomes admin; repo-scoped permissions
  (read/write/read-write/admin) plus owner and server-admin roles
- Multipart package push with control-field extraction, list/show/delete,
  pool serving, blob ref-count cleanup
- Audit log

CLI (urapt):
- register/login/logout/whoami, token management
- repo/distro/component/arch CRUD, member management
- push/pull/ls/show/rm for packages
- apt-config helper that emits apt setup commands (key, sources.list,
  auth.conf for private repos)

Packaging & docs:
- Dockerfile (multi-stage distroless), docker-compose.yml, sample config
- README quick start, architecture overview, config reference, security notes
- PLAN.md design blueprint, CHANGELOG.md, GPL-3.0 LICENSE
- GitHub Actions CI (test, lint, cross-build for linux/darwin amd64/arm64)
- Makefile release target producing static binaries + tarballs + checksums

Tests cover the data-access layer, auth/permission checks, APT index
generation, .deb parsing, GPG signing, the REST API, and the typed API
client. Verified end-to-end on a Raspberry Pi (arm64) pushing and installing
a real package.

cli/commands/root.go

@@ -0,0 +1,168 @@
+// Package commands implements the urapt CLI command tree using cobra.
+package commands
+
+import (
+	"fmt"
+	"os"
+
+	"github.com/spf13/cobra"
+
+	"urapt/cli/config"
+	"urapt/shared/apiclient"
+)
+
+// Root holds the urapt CLI runtime state: the version, loaded config, and
+// flag overrides. It builds and executes the cobra command tree.
+type Root struct {
+	version string
+
+	cfg *config.File
+
+	flagServer string
+	flagUser   string
+	flagToken  string
+	flagJSON   bool
+
+	rootCmd *cobra.Command
+}
+
+// New constructs the CLI root.
+func New(version string) *Root {
+	r := &Root{version: version}
+	r.build()
+	return r
+}
+
+// Execute runs the command tree with the given args.
+func (r *Root) Execute(args []string) error {
+	r.rootCmd.SetArgs(args)
+	err := r.rootCmd.Execute()
+	if err != nil {
+		fmt.Fprintln(os.Stderr, "error:", err)
+	}
+	return err
+}
+
+// build constructs the cobra root and attaches subcommands.
+func (r *Root) build() {
+	r.rootCmd = &cobra.Command{
+		Use:   "urapt",
+		Short: "urapt is a CLI for managing packages on a self-hosted urapt APT server",
+		Long: "urapt pushes and manages Debian packages on a self-hosted urapt\n" +
+			"server. Log in once, then push .deb files to your repositories.",
+		SilenceUsage:  true,
+		SilenceErrors: true,
+	}
+	r.rootCmd.PersistentFlags().StringVar(&r.flagServer, "server", "", "urapt server URL (overrides config)")
+	r.rootCmd.PersistentFlags().StringVar(&r.flagUser, "user", "", "username (overrides config)")
+	r.rootCmd.PersistentFlags().StringVar(&r.flagToken, "token", "", "API token (overrides config)")
+	r.rootCmd.PersistentFlags().BoolVar(&r.flagJSON, "json", false, "output JSON")
+
+	r.rootCmd.AddCommand(
+		r.versionCmd(),
+		r.loginCmd(),
+		r.logoutCmd(),
+		r.whoamiCmd(),
+		r.registerCmd(),
+		r.tokenCmd(),
+		r.repoCmd(),
+		r.distroCmd(),
+		r.componentCmd(),
+		r.archCmd(),
+		r.pushCmd(),
+		r.pullCmd(),
+		r.lsCmd(),
+		r.showCmd(),
+		r.rmCmd(),
+		r.aptConfigCmd(),
+	)
+}
+
+// loadConfig lazily loads the CLI config file (once).
+func (r *Root) loadConfig() error {
+	if r.cfg != nil {
+		return nil
+	}
+	cfg, err := config.Load()
+	if err != nil {
+		return err
+	}
+	r.cfg = cfg
+	return nil
+}
+
+// server resolves the effective server URL (flag > env > config).
+func (r *Root) server() (string, error) {
+	if err := r.loadConfig(); err != nil {
+		return "", err
+	}
+	if r.flagServer != "" {
+		return r.flagServer, nil
+	}
+	if v := os.Getenv("URAPT_SERVER"); v != "" {
+		return v, nil
+	}
+	if r.cfg.Default.Server != "" {
+		return r.cfg.Default.Server, nil
+	}
+	return "", fmt.Errorf("no server configured: run `urapt login <server>` or pass --server")
+}
+
+// token resolves the effective API token (flag > env > config).
+func (r *Root) token() (string, error) {
+	if r.flagToken != "" {
+		return r.flagToken, nil
+	}
+	if v := os.Getenv("URAPT_TOKEN"); v != "" {
+		return v, nil
+	}
+	if err := r.loadConfig(); err != nil {
+		return "", err
+	}
+	if r.cfg.Default.Token != "" {
+		return r.cfg.Default.Token, nil
+	}
+	return "", fmt.Errorf("not logged in: run `urapt login`")
+}
+
+// client builds an authenticated client using the resolved server + token.
+func (r *Root) client() (*apiclient.Client, error) {
+	server, err := r.server()
+	if err != nil {
+		return nil, err
+	}
+	tok, _ := r.token()
+	return apiclient.New(server, tok), nil
+}
+
+// unauthClient builds a client with only the server resolved (for login/register).
+func (r *Root) unauthClient(server string) (*apiclient.Client, error) {
+	if server == "" {
+		var err error
+		server, err = r.server()
+		if err != nil {
+			return nil, err
+		}
+	}
+	return apiclient.New(server, ""), nil
+}
+
+// saveProfile persists the given server/user/token as the default profile.
+func (r *Root) saveProfile(server, user, token string) error {
+	if err := r.loadConfig(); err != nil {
+		return err
+	}
+	r.cfg.Default.Server = server
+	r.cfg.Default.User = user
+	r.cfg.Default.Token = token
+	return config.Save(r.cfg)
+}
+
+// clearProfile removes the stored token (used by logout).
+func (r *Root) clearProfile() error {
+	if err := r.loadConfig(); err != nil {
+		return err
+	}
+	r.cfg.Default.Token = ""
+	return config.Save(r.cfg)
+}