feat(cloud): add headless cloud CLI control plane

[juliusmarminge]

Summary

• add t3 cloud link, t3 cloud status, and t3 cloud unlink for headless T3 Cloud management
• persist desired cloud exposure independently of a running server and reconcile the managed tunnel on the next server startup
• authorize the CLI through a Clerk public OAuth PKCE client with refresh-token persistence and relay OAuth bearer verification fallback
• document relay OAuth application setup and the current SSH loopback callback forwarding requirement

Behavior

t3 cloud link works when no T3 server is running. It installs the managed cloudflared binary, completes Clerk OAuth authorization, stores desired exposure, and tells the user that the next t3 serve or t3 start will expose the tunnel. When a server is already reachable, it reconciles immediately.

t3 cloud unlink disables desired exposure first, asks a reachable server to stop its managed connector, and best-effort revokes the relay-side environment record.

Testing

• bun fmt
• bun lint
• bun typecheck
• bun run test

Stack

Stacked on #2837.

---

Note

High Risk
Touches authentication, persisted credentials, relay linking, and automatic outbound reconciliation on server startup; misconfiguration could affect exposure or startup behavior.

Overview
Adds a headless t3 cloud CLI (login, link, status, unlink, logout) gated on build-time public config (T3CODE_CLERK_CLI_OAUTH_CLIENT_ID, relay URL, Clerk publishable key). The CLI uses Clerk PKCE OAuth with tokens in the secret store, persists desired exposure separately from a running server, and can install managed cloudflared before linking.

On server startup, if exposure was requested, reconcileDesiredCloudLink completes the relay environment link using the stored CLI credential (no new HTTP reconcile route). Release builds and .env.example now require the CLI OAuth client ID; release workflow passes it into desktop/CLI builds.

Desktop/web Clerk API calls allow only hosts derived from the publishable key (replacing hardcoded suffix checks). The desktop app opens off-origin navigations (e.g. OAuth) in the system browser and adapts Clerk connected-account flows to the native t3code:// callback bridge.

^{Reviewed by Cursor Bugbot for commit b8989d6. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add headless CLI OAuth control plane for T3 Cloud link and relay management

• Adds a t3 cloud CLI subcommand that is conditionally available based on build-time public config (T3CODE_CLERK_CLI_OAUTH_CLIENT_ID, relay URL, Clerk publishable key); when config is absent the subcommand exits with a help error
• Introduces CloudCliTokenManager to store, retrieve, and exchange CLI OAuth (PKCE) credentials in ServerSecretStore, and CliState to track and clear the desired-cloud-link flag and all persisted relay secrets
• Adds reconcileDesiredCloudLink in cloud/http.ts: on server startup, if a desired-link flag is set, the server automatically completes the relay link using the stored CLI credential without requiring an HTTP endpoint
• Adds a makeDesktopClerkExternalAccountAdapter in desktopClerkExternalAccounts.ts that intercepts createExternalAccount and reauthorize calls to use a native bridge callback URL and reloads the user on completion
• Hardens Clerk Frontend API hostname validation across desktop and web by deriving allowed hosts from the publishable key via new relayAuth utilities (clerkFrontendApiHostnameFromPublishableKey, isAllowedClerkFrontendApiHostname) instead of hardcoded suffix checks
• Risk: server startup now attempts an outbound relay HTTP request when the desired-link flag is set; failures are logged as warnings but may slow startup or produce noise in misconfigured environments

^{Macroscope summarized b8989d6.}