feat(cli): Add Agent & Session Management Commands to nexus-cli

[sangalo20]

Overview

Extend nexus-cli with commands to manage agents and sessions from the terminal, following the same pattern as the existing plan/apply provider management commands.

Problem

• Registering agents currently requires raw curl calls
• No CLI tooling for inspecting active sessions or troubleshooting auth issues
• Operators have no visibility into which agents are registered and what scopes they hold

Proposed Commands

Agent management

# Register an agent
nexus-cli agents register --id crm-agent --scopes "crm:contacts:read,crm:contacts:write" --description "CRM read/write agent"

# List all registered agents
nexus-cli agents list

# Deactivate an agent
nexus-cli agents deactivate --id crm-agent

Session management

# List active sessions (optionally filter by agent)
nexus-cli sessions list [--agent crm-agent]

# Inspect a specific session
nexus-cli sessions get --id sess_abc123

# Force-close a session
nexus-cli sessions close --id sess_abc123

Manifest support (Security-as-Code extension)

Allow agents to be declared in the existing nexus-providers.yaml manifest:

agents:
  - id: crm-agent
    description: CRM read/write agent
    allowed_scopes:
      - crm:contacts:read
      - crm:contacts:write
  - id: ops-agent
    allowed_scopes:
      - acme:gliding
      - acme:flaring

So nexus-cli apply handles both providers and agents in a single operation.

Acceptance Criteria

• nexus-cli agents register/list/deactivate commands implemented
• nexus-cli sessions list/get/close commands implemented
• Agent manifest section supported in nexus-providers.yaml schema
• plan command includes agent drift detection
• Help text for all new commands

Priority

P8 — Medium effort

Reference

AGENT_AUTH_PROPOSAL.md — Implementation Priority