Implement CLI commands and admin API endpoints

- Add bootstrap command with direct DB access for initial setup
- Implement auth login/logout/status CLI commands
- Implement user create/confirm-email CLI commands
- Implement org create/list/add-site CLI commands
- Add admin.orgs.* and admin.users.* API endpoints
- Add password hashing utility with scrypt
- Add token hashing and authentication utility
- Add superuser runtime checks for admin endpoints
- Wrap multi-step operations in transactions
- Fix config file permissions (0o600) for security
- Remove token display from status command
- Add return statements to void handlers
- Add reviq CLI command to devenv

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

apps/cli/src/utils/config.ts

@@ -0,0 +1,58 @@
+/**
+ * CLI configuration utilities
+ * Stores credentials at ~/.config/reviq/credentials.json
+ */
+
+import { mkdir, readFile, unlink, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+export interface Config {
+  apiUrl: string;
+  token: string;
+  email: string;
+}
+
+const CONFIG_DIR = join(homedir(), ".config", "reviq");
+const CONFIG_FILE = join(CONFIG_DIR, "credentials.json");
+
+/**
+ * Get the path to the config file
+ */
+export const getConfigPath = (): string => CONFIG_FILE;
+
+/**
+ * Read the config file
+ * Returns null if the file doesn't exist or is invalid
+ */
+export const readConfig = async (): Promise<Config | null> => {
+  try {
+    const data = await readFile(CONFIG_FILE, "utf-8");
+    return JSON.parse(data) as Config;
+  } catch {
+    return null;
+  }
+};
+
+/**
+ * Write the config file
+ * Creates the config directory if it doesn't exist
+ */
+export const writeConfig = async (config: Config): Promise<void> => {
+  await mkdir(CONFIG_DIR, { recursive: true, mode: 0o700 });
+  await writeFile(CONFIG_FILE, JSON.stringify(config, null, 2), {
+    mode: 0o600,
+  });
+};
+
+/**
+ * Delete the config file
+ * Ignores errors if the file doesn't exist
+ */
+export const deleteConfig = async (): Promise<void> => {
+  try {
+    await unlink(CONFIG_FILE);
+  } catch {
+    // Ignore if doesn't exist
+  }
+};