feat(ingest): add hotdata ingest command group

Drives the dlthubworker ingest API (/v1/ingest/*) through the gateway via
a raw-HTTP client (routes aren't in the SDK yet): sql/rest/filesystem/
iceberg onboarding, restricted SQL queries, translate, connector catalog,
status, drain, schema, preview, and parquet download.

Reconciled against the stable post-gateway API (2026-07-07 rollout):

- enqueue (POST /sources|/queries) sends the durable hd_ API key as the
  bearer — the server rejects JWTs there because the drain job outlives
  them; without an API key the CLI fails fast with a --api-key hint
- verified live: the CLI's user-scoped session JWT only reaches
  /connectors — workspace-scoped endpoints 403 (the worker derives the
  workspace from the JWT's workspace:* scope and ignores X-Workspace-Id
  on the JWT route), so those 403s get an --api-key hint too
- no `ingest sources` command: GET /ingest/sources never shipped
- 2.5s status polling, drain re-kick after 30s pending (control-store
  read lag), brief 404 retry on `ingest query` right after onboarding,
  and a database-scoped-token hint when a load fails with Forbidden

Author: eddietejeda

src/cli.rs

@@ -4,6 +4,7 @@ use crate::commands::context::ContextCommands;
 use crate::commands::databases::DatabasesCommands;
 use crate::commands::embedding_providers::EmbeddingProvidersCommands;
 use crate::commands::indexes::IndexesCommands;
+use crate::commands::ingest::IngestCommands;
 use crate::commands::jobs::JobsCommands;
 use crate::commands::queries::QueriesCommands;
 use crate::commands::query::QueryCommands;
@@ -132,6 +133,21 @@ pub enum Commands {
         command: Option<JobsCommands>,
     },
 
+    /// Ingest data from external connectors (databases, REST APIs, files, Iceberg)
+    /// into a managed database via the hotdata ingest service
+    Ingest {
+        /// Workspace ID (defaults to first workspace from login)
+        #[arg(long, short = 'w', global = true)]
+        workspace_id: Option<String>,
+
+        /// Output format
+        #[arg(long = "output", short = 'o', default_value = "table", value_parser = ["table", "json", "yaml"], global = true)]
+        output: String,
+
+        #[command(subcommand)]
+        command: IngestCommands,
+    },
+
     /// Manage indexes on a table
     Indexes {
         /// Workspace ID (defaults to first workspace from login)

src/client.rs

@@ -1,5 +1,6 @@
 pub mod credentials;
 pub mod database_session;
+pub mod ingest;
 pub mod jwt;
 pub mod raw_http;
 pub mod sdk;