feat(miner): add loopover-miner tenant create/list/destroy admin CLI over the control-plane provisioning API

[JSONbored]

Context

#7173 ratified the shared ORB+AMS hosting control-plane architecture (one isolated Cloudflare
Container per tenant, orchestrated via #7180's provisioning API). #5220 (now closed, design
settled) worked out that AMS's own admin surface for this doesn't need a new API — it needs a thin
CLI wrapper on the existing loopover-miner binary that calls #7180's provisioning API over
authenticated HTTP, reusing #7180's own lifecycle states (provisioning/active/suspended/
torn down) and #7174's generalized secret-broker auth (already merged via #7187) rather than
inventing AMS-specific versions of either.

The pattern to follow already shipped tonight: packages/loopover-miner/lib/discovery-index-client.js
(queryDiscoveryIndex/submitSoftClaim) is a Bearer-authed HTTP client from the miner CLI to a
separate hosted service, with its own *-cli.js command-parsing conventions
(packages/loopover-miner/lib/portfolio-queue-cli.js for argv parsing shape,
packages/loopover-miner/lib/discover-cli.js for the async CLI-command pattern).

Requirements

• New loopover-miner tenant subcommand group: tenant create <name> [--product ams] [--json],
  tenant list [--json], tenant destroy <name> [--json].
• Calls Provisioning core: create/destroy a tenant's Container + Postgres DB #7180's control-plane provisioning API over authenticated HTTP (Bearer token from an admin
  credential env var, distinct from a tenant's own per-instance secrets).
• No new lifecycle-state vocabulary — pass through exactly what Provisioning core: create/destroy a tenant's Container + Postgres DB #7180's API reports.
• Admin-command failures must be loud (non-zero exit, clear error), never fail-open (unlike
  discovery-index-client.js's deliberately fail-open opportunistic-supplement design — this is a
  deliberate admin action, not a best-effort enrichment).
• Flag-gated the same way the discovery-plane client is (LOOPOVER_MINER_* env var), off by
  default, so this ships inert until an operator/admin actually configures the control-plane URL.

Deliverables

• packages/loopover-miner/lib/tenant-cli.js (or extends an existing CLI module if a better
  home emerges during implementation): argv parsing + runTenantCreate/runTenantList/
  runTenantDestroy
• HTTP client wired the same way discovery-index-client.js is (injectable fetch, Bearer
  auth, typed request/response shapes)
• Wired into bin/loopover-miner.js's command dispatch
• Regression tests for both the argv-parsing and HTTP-call layers, including the control-plane
  unreachable/error-response path (loud failure, not silent)

Test Coverage Requirements

packages/loopover-miner/lib/** is covered by Codecov's 99% patch-coverage gate. Every new
??/ternary/error-path branch needs both sides covered — mirrors tonight's
discovery-index-client.js test shape (success path + failure path + malformed-response path for
every HTTP call).

Expected Outcome

An admin can create/list/destroy a hosted AMS tenant instance from the same loopover-miner
binary operators already use, without needing a separate tool or hand-rolled curl calls against
the control-plane API.

Links & Resources

• Provisioning core: create/destroy a tenant's Container + Postgres DB #7180 (the provisioning API this CLI calls — implement that first; this issue is blocked on it)
• Generalize src/orb/broker.ts into a multi-secret-type broker shared by ORB + AMS hosted #7174 / feat(orb): add a secret_type discriminator to the enrollment broker #7187 (the broker generalization this reuses for admin auth)
• packages/loopover-miner/lib/discovery-index-client.js — the HTTP-client pattern to mirror
• packages/loopover-miner/lib/portfolio-queue-cli.js — the argv-parsing convention to mirror
• Design: provisioning API/CLI to stand up a new hosted AMS tenant instance #5220 (closed — the design this implements)

[linear-code]

JSO-5068