Build an official OpenAPI-based Apollo CLI

## Background Refs #5573. The Portal OpenAPI migration is now complete, so Apollo has a practical contract foundation for command-line tooling and agent-assisted workflows. This issue tracks the first incremental step: provide an official `apollo` CLI on top of the existing Portal OpenAPI contract. The initial CLI should be useful for humans, scripts, CI jobs, and AI coding tools such as Codex or Claude Code. ## Goal Build an OpenAPI-first `apollo` CLI without introducing a new Agent principal or server-side agent authorization model in v0. The CLI should: - use existing `/openapi/v1/*` Portal OpenAPI endpoints - use existing Consumer token authentication - provide human-friendly commands for common Apollo configuration workflows - provide stable machine-readable JSON output for tools - avoid deprecated Portal WebAPI endpoints - be implemented as an independent Rust CLI unless the design review chooses otherwise ## Initial command scope High-level v0 commands should cover: - `apollo auth login/status/logout` - `apollo profile list/use` - `apollo app list/get` - `apollo env list` - `apollo namespace list/get/create` - `apollo config list/get/set/delete/diff/apply` - `apollo release list/create/rollback` Also provide a `gh api`-style escape hatch: - `apollo api <method> <path>` This allows users and tools to call OpenAPI endpoints that do not yet have high-level command UX. ## Out of scope for v0 - New server-side Agent principal model - User-sponsored agent session authorization - MCP server or other protocol adapters - High-level UX for admin-heavy operations such as user, consumer, permission, access key, and server config management, unless separately scoped ## Acceptance criteria - CLI can authenticate with an existing Consumer token. - CLI profile/config behavior is documented. - Representative app, env, namespace, config, and release commands call OpenAPI endpoints only. - `--output json` is supported for tool-facing workflows. - Mutating commands have safe confirmation behavior, with explicit non-interactive override. - `apollo api` can call arbitrary supported OpenAPI endpoints. - No Apollo server schema change is required for the first usable version.