Switch all CLI commands to use ConnectRPC clients instead of gRPC clients.
This decouples the CLI from the legacy gRPC server, preparing for its removal.

Key changes:
- cmd/client.go: Replace gRPC dial with ConnectRPC HTTP client factory
- cmd/context.go: Replace gRPC metadata with generic newRequest[T] helper
- All command files: Use connect.NewRequest() / newRequest() patterns
- Response access: res.GetField() -> res.Msg.GetField()
- Remove gRPC connection lifecycle (cancel, defer cancel)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

bot reviewed Feb 17, 2026

ConnectRPC wraps connection errors in *connect.Error instead of
returning context.DeadlineExceeded directly. Update test assertions
to use wantErr flag for connection-failure cases.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Avoids sending auth headers over unencrypted HTTP by default.
Users can still explicitly use http:// for local development.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

parseHeader and newRequest now return errors when the header string
is invalid (missing colon separator), preventing silent failures
when users pass malformed --header values.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Replace http.DefaultClient (no timeout) with a client configured
with a 30-second timeout to prevent CLI commands from hanging
indefinitely if the server stalls.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>