feat(client): cloud-http transport resolver — self_hosted clients actually use the cloud (B2/B5)

[andrei-hasna]

What

The B2 core fix. Setting a client to cloud/self_hosted was a no-op — the CLI/MCP kept reading the local SQLite/db.json store. A DSN on the client does not switch the dataset a CLI reads.

Adds a shared client-flip mechanism in @hasna/contracts (root + ./client subpath) that every app's storage resolver adopts:

• resolveClientTransport(name, env) — decides local vs cloud-http. Transport is cloud-http IFF resolved mode is cloud AND an API key is present. Base URL defaults to https://<app>.hasna.xyz; /v1 appended. If cloud is requested but the key is missing / URL invalid → returns local + misconfigured: true with a loud warning (never silently serves wrong local data).
• createHasnaHttpTransport() — authenticated fetch client for <base>/v1; sends the key as both x-api-key and Authorization: Bearer; typed errors; never logs the key.
• createClientTransport() — resolve + build in one call; throws on misconfig.

The flip contract (env), per app <NAME>

var	meaning
HASNA_<NAME>_STORAGE_MODE / HASNA_<NAME>_MODE	cloud | self_hosted | local
HASNA_<NAME>_API_URL	base (default https://<app>.hasna.xyz)
HASNA_<NAME>_API_KEY	hasna_<app>_...

Rollback = unset those; the local original is never touched.

B5

The transport routes ALL reads+writes through the app's HTTP API, so the data source is the server (whatever it persists — db.json items, not just sqlite tables).

Proof

src/client/transport.test.ts stands up a real loopback /v1 server + a demo storage resolver using the shared code and proves: flip on → reads/writes hit the cloud server (write lands in the server store, local file untouched); flip off → local file; key sent + enforced. 13/13 pass; full suite 156 pass / 0 fail; typecheck + build clean.

Follow-on (not in this PR)

• Per-app storage-resolver adoption (todos CLI is coupled to raw bun:sqlite via getDatabase(); knowledge to db.json + an older /api/v1/* contract) — each needs a small resolver swap to route through this transport.
• Publish after merge (branch is based on origin/main, which is behind npm 0.4.2; publishing from this base would regress — reconcile main first).

[andrei-hasna]

Adds the HTTP storage client on top of the cloud-http transport (commit ccc7f5f):

• createHasnaStorageClient(name, transport) — the app storage interface over /v1: list (GET, extracts items/total), get (GET /:id, 404→null), create (POST + auto Idempotency-Key), update (PATCH default / PUT), delete (DELETE /:id, 204/404 ok).
• resolveStorageClient(name, env) — the single call an app's resolver makes: returns a ready client on cloud-http (mode=self_hosted + API_URL + API_KEY), else {transport:'local',client:null}; throws if cloud requested but misconfigured.
• Transport: per-call query, retries (exp backoff+jitter; idempotent methods + POST-with-key only), caller-abort propagation, HasnaHttpError on non-2xx.
• Live conformance test round-trips create→get→list→update→delete against knowledge.hasna.xyz/v1 (key from Secrets Manager; skips offline).
• Exported from root + @hasna/contracts/client/storage. verify:release green; version 0.5.0.