Add the identity command and serve it on an opt-in HTTP info API

Build slackhq/nebula#1821 ("who is this vpn address?" over a local
HTTP+JSON socket) on the command registry, so the lookup is one command
on every surface and the socket is one more local API.

identity
- `identity [-address <vpn addr>[:port]]`: no address reports this node;
  with one, this node or the peer behind an established tunnel
- Certificate fields only: name, vpn addresses, networks, unsafe
  networks, groups, fingerprint, issuer, validity, cert version; a peer's
  fingerprint is the one nebula computed when it verified the cert
- Port accepted and stripped, 4in6 unmapped, so a RemoteAddr passes
  straight through
- No tunnel is a commands.NotFound; an empty -address is refused
- Lighthouse TXT lookup shares the owner and peer lookups, keeps answering
  with the initiating certificate, and no longer panics without a default cert
- Served on ssh and nebula ctl too

Info API
- Off until `local_api.info.enabled` with `socket` and optional quoted
  octal `socket_mode` (default "0600"); nothing derived
- Serves commands declaring Command.Identity plus help; others 403 naming
  their surfaces. TestInfoAPISurface pins the set to identity
- GET /v1 is the schema; GET /v1/<cmd>?<flag>=<value> runs one; body is
  the -json rendering via commands.Render; commands.PresentationFormat
  reads json/pretty from the query the way a line is read
- 400 commands.ParamError, 403 commands.WithheldError (what Resolve now
  returns for a withheld name, so help and dispatch type-check it too),
  404 NotFound or unknown, 500 Run error, refusal with no reason, or
  recovered panic with no detail; no redirects; every miss is JSON
- listen takes a mode: bind under umask 0077 then chmod; "0660" plus a
  searchable dir opens it to a group
- The chmod, at bind and on a mode-only reload, goes through chmodSocket,
  which never follows a link: a user who can write the socket's directory
  could otherwise swap the node for a link and have a root daemon put
  0660 or 0666 on any file. Only a socket we own is chmoded. On linux the
  node is held open O_PATH|O_NOFOLLOW, checked by fstat, and chmoded
  through /proc/self/fd, so the check and the chmod land on one inode;
  fchmodat2 is the fallback without /proc. On darwin and the BSDs it is
  an Lstat check and fchmodat(AT_SYMLINK_NOFOLLOW). clearStale Lstats
  too, so a dangling link is refused rather than followed by bind on
  darwin
- One endpoint type owns bind under mutex, bind-before-release move,
  context watch and stop/unlink; each server supplies what it serves
- Reloadable through the same reconcile shape as the control socket:
  mode applied in place, unparsable section keeps what runs, control
  socket path refused by name
- Wire returns Endpoints{Control, Info} with one Stop
- Windows unsupported for now (a pipe has no mode); warned once

Tests: identity lookups and shapes; API filter, status codes, panic
recovery, socket mode, rebind, cancellation; config parsing incl. bare
0660; Wire transitions; e2e of two nebulas with the info API resolving
the peer by address and port, through shared test.HTTPDo/HTTPGet helpers.
Goldens gain identity.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

commands_test.go

@@ -6,10 +6,7 @@ import (
 	"io"
 	"net/netip"
 	"testing"
-	"time"
 
-	"github.com/slackhq/nebula/cert"
-	"github.com/slackhq/nebula/cert_test"
 	"github.com/slackhq/nebula/commands"
 	"github.com/slackhq/nebula/logging"
 	"github.com/slackhq/nebula/test"
@@ -69,36 +66,10 @@ func TestPrintRelaysReportsErrorsAsText(t *testing.T) {
 	assert.Contains(t, marshal(), `"Error":"hostmap LocalIndex '7' does not match RelayState LocalIndex"`)
 }
 
-// tunnelFixture is an Interface with our own certificate loaded, one peer behind an
-// established tunnel and one still handshaking, which has no certificate yet.
-func tunnelFixture(t *testing.T) *Interface {
-	t.Helper()
-
-	l := test.NewLogger()
-	me := netip.MustParseAddr("10.0.0.1")
-	peer := netip.MustParsePrefix("10.0.0.2/24")
-
-	ca, _, caKey, _ := cert_test.NewTestCaCert(cert.Version2, cert.Curve_CURVE25519, time.Time{}, time.Time{}, nil, nil, nil)
-	peerCert, _, _, _ := cert_test.NewTestCert(cert.Version2, cert.Curve_CURVE25519, ca, caKey, "peer", time.Time{}, time.Time{},
-		[]netip.Prefix{peer}, nil, []string{"web", "db"})
-
-	hm := newHostMap(l)
-	hm.Hosts[peer.Addr()] = &HostInfo{
-		vpnAddrs:        []netip.Addr{peer.Addr()},
-		ConnectionState: &ConnectionState{peerCert: &cert.CachedCertificate{Certificate: peerCert}},
-	}
-	hm.Hosts[netip.MustParseAddr("10.0.0.3")] = &HostInfo{
-		vpnAddrs:        []netip.Addr{netip.MustParseAddr("10.0.0.3")},
-		ConnectionState: &ConnectionState{},
-	}
-
-	return &Interface{pki: newTestPKI(t, "me", []netip.Addr{me}), hostMap: hm}
-}
-
 // TestPrintCertOfATunnelWithoutACertificate: a tunnel still handshaking, or one being
 // torn down, has no certificate, and print-cert refuses rather than panicking.
 func TestPrintCertOfATunnelWithoutACertificate(t *testing.T) {
-	f := tunnelFixture(t)
+	f, _ := identityFixture(t)
 
 	r, err := runPrintCert(f, &printCertFlags{}, []string{"10.0.0.3"})
 	require.NoError(t, err)