refactor!: rebuild on the Helmcode CLI structure

[crstian19]

What

nan-cli rebuilt on the same structure, Charm stack and tooling as the Helmcode CLI, so both are maintained the same way. Every feature of nan stays; the session file, the commands, their flags, output and exit codes, and what each tool writer puts into a config are unchanged.

Structure

• cmd/nan for the entry point, and internal/{build,api,session,tools,models,flow,pulse,cli,runs,ui,update}, as in the Helmcode CLI.
• Bubble Tea v2, Bubbles v2, Lip Gloss v2, huh and fang, replacing Bubble Tea v1 and the single internal/tui/tui.go.
• golangci-lint with the shared config (new CI job), lefthook, mise and a justfile.

Dashboard

• Seven numbered areas, always on screen: Home, Profile, Usage, Models, Costs, Harnesses, About. 1-7/tab move, enter opens a menu of what a row allows, / finds anything, t takes a short tour.
• Home says what needs attention: not signed in, an expired session, a missing or refused key, a tool installed but not pointed at NaN, a newer release. Models new to your key show there too.
• The NaN identity stays: violet palette, wordmark and the mascot, whose face follows what the dashboard is doing.
• Sign-in, key and tool setup are huh forms. s signs in, o signs out (twice), e opens the setup from any area.

Commands

• run, runs, automations, approvals, secrets, me, metrics and auth keep their flags, output and exit codes (0-4, 10, 64, 65, 69, 75). Their code moved as it was and its tests pass.
• New: nan setup, nan setup status, nan setup remove.
• Errors are framed by fang but printed as written (fang's default title-cases the first word, which turned not-an-id into Not-An-Id). To a pipe, only the message, as before.
• A newer release is mentioned after a command, at most once a day, from the public GitHub releases.

Compatibility notes

• ~/.config/nan/session.json keeps its path on every OS and its fields.
• Each tool writer (Factory, OpenCode, Pi, Codex, Hermes) moved unchanged; all of its tests pass.
• Behaviour change: a key the cluster refuses is no longer saved. One that cannot be checked because the cluster is unreachable is still accepted, and the screen says it was not checked.
• THIRD-PARTY-NOTICES.txt now ships inside every archive (cobra is Apache-2.0). The installer extracts the archive and installs nan by name, so it is unaffected.
• internal/build.Version is 0.2.0: merging this publishes v0.2.0 through tag.yml.

Open PRs

#32, #34 and #40 touch the files this replaces and will need rebasing onto the new layout; the theme toggle in #40 maps onto internal/ui/theme.go.

Checked

• go test -race ./..., golangci-lint run (0 issues), golangci-lint fmt --diff, govulncheck.
• Driven by hand in a terminal against a local stand-in (NAN_API_URL): every area, the first run, the sign-in, the errors and exit codes.