Drives the dlthubworker ingest API (/v1/ingest/*) through the gateway via
a raw-HTTP client (routes aren't in the SDK yet): sql/rest/filesystem/
iceberg onboarding, restricted SQL queries, translate, connector catalog,
status, drain, schema, preview, and parquet download.

Reconciled against the stable post-gateway API (2026-07-07 rollout):

- enqueue (POST /sources|/queries) sends the durable hd_ API key as the
  bearer — the server rejects JWTs there because the drain job outlives
  them; without an API key the CLI fails fast with a --api-key hint
- verified live: the CLI's user-scoped session JWT only reaches
  /connectors — workspace-scoped endpoints 403 (the worker derives the
  workspace from the JWT's workspace:* scope and ignores X-Workspace-Id
  on the JWT route), so those 403s get an --api-key hint too
- no `ingest sources` command: GET /ingest/sources never shipped
- 2.5s status polling, drain re-kick after 30s pending (control-store
  read lag), brief 404 retry on `ingest query` right after onboarding,
  and a database-scoped-token hint when a load fails with Forbidden

The enqueue body's credentials / rest_config / catalog_config subtrees
(SQL passwords, connection strings, REST bearer tokens, catalog tokens,
object-store keys) were printed verbatim to stderr under --debug. Log a
view with those subtrees replaced by "***" instead; the wire body is
unchanged. Mirrors jwt.rs's redacted_form_body pattern.

…t/refresh

Collapse the sprawling 13-subcommand surface into the same shape as
`hotdata connections`, focused on a guided, catalog-driven onboarding
flow:

  new       interactive wizard, driven by the connector catalog
  list      the sources you've ingested (result databases)
  create    scriptable onboarding; `create list` browses the catalog
  import    SQL front-door (renamed from `query`); defaults to a
            reasonable sample (SELECT * FROM <source> LIMIT 1000) when
            no query is given
  refresh   re-drain + poll an ingest to completion

The `new` wizard is catalog-driven: the /ingest/connectors catalog
returns a `template` per REST service with base_url, auth shape, and
resources already filled in, so the wizard prompts only for the
`<PLACEHOLDER>` secrets — the user never types a URL the catalog knows.
Keyless services (auth "none") onboard with zero prompts.

Dropped as separate verbs: sql/rest/filesystem/iceberg (folded into
new/create by family), translate, connectors (→ `create list`),
status/drain (folded into the run+poll loop), schema/preview/download
(the read side is the core `query`/`databases`/`results` commands).

Client: ConnectorEntry now carries `auth` + `template`; dropped the
translate/schema/preview/download methods and types.

Catalog display drops redundant SQL dialect aliases (the server lists
both postgres/postgresql and mssql/sqlserver with identical labels):
the wizard and `create list` show the canonical name only, while
`create --service <alias>` still resolves against the full catalog.

Verified live against prod: `create list`, `list`, request assembly
from the catalog template, `import` default-query synthesis and
id-pinning, and `refresh` (drain + poll). A full `POST /sources`
onboard currently hangs server-side in the deploy path (unrelated to
the CLI — /queries, /drain, /jobs, /connectors all respond fast).

`ingest new`/`create` now run in the server's validate_only mode: connect, reflect the schema, load NO rows. On completion they print the discovered tables + columns and point at `ingest import` to pull data. Dropped the --validate-only flag (it's the only behavior now); re-added the client schema() call to fetch the discovered metadata; poll_ingest returns the terminal status so each verb renders its own result (connection-added vs imported).

new-import and trigger-import no longer block the terminal. They
enqueue, fire the drain that processes the job (the worker is on-demand
-- the old --no-wait skipped this, leaving jobs pending forever), print
the ingest id + database + a tracking hint, and return. --wait opts
into the old blocking poll. new-connection keeps its blocking default
deliberately: its output IS the feedback (credentials validated, schema
discovered); --no-wait still opts out there.

New `ingest status <id>`:
- one-shot by default with script-friendly exit codes mirroring
  `query status`: 0 done, 1 failed, 2 still in flight; prints the
  worker's failure detail when there is one
- --wait attaches and polls to a terminal state; the poll still
  re-kicks a job stuck in `pending` (control-store read lag), so
  attaching also rescues an import whose first drain missed the row

The wait poll now tolerates transient errors: a single gateway blip
(403/5xx, dropped connection) mid-poll retried up to 3 consecutive
times instead of killing the wait (seen live: a one-off empty-body 403
aborted an otherwise-healthy wait).

Verified live against prod: non-blocking enqueue returns in ~2s with
the pending ack, status one-shot exits 0/2 correctly, status --wait
attaches to done.

done -> green, failed -> red, in-flight -> yellow — the repo's status
scheme (jobs::get). Table cells are ANSI-safe via tabled's ansi feature.

Bugs:
- new-connection --no-wait now fires the drain before returning; the
  worker is on-demand, so the onboard previously sat pending forever.
- The wait poll keeps its 0/1/2 exit contract at the deadline: a
  transient poll error AT the deadline is a timeout (exit 2, job may
  still be running), not an ingest failure (exit 1).
- The wizard no longer silently discards flags: new-connection with
  flags but no --service on a TTY refuses instead of prompting from
  scratch and dropping the input (CreateArgs::any_given).
- Misleading failures fixed: --wait with -o json|yaml renders the
  status object (with the worker detail) on stdout on failure, matching
  one-shot status; a pinned connection id that fails to resolve is its
  own error instead of blaming the --source flag; the by-name 404 retry
  drops 3 -> 1 so a typo'd name reads as a typo, not 7.5s of lag.

Reuse (the repo already had these):
- util::color_status (grew a "done" arm; unknown statuses now render
  yellow = in-flight, since terminal states are all named) and
  util::format_date replace the local colored_status/date_only — the
  CREATED column now matches every other table in the CLI.
- IngestError::message humanizes bodies via util::api_error and exit
  prints the standard re-auth hint on 401, so an expired session gets
  the same treatment as SDK-backed commands.
- IngestClient::new applies the same empty/PLACEHOLDER api-key filter
  as sdk::Api/credentials (and documents why HOTDATA_DATABASE_TOKEN is
  deliberately not consulted).
- The inquire prompt helpers move to commands/prompt.rs for sharing
  (connections/interactive.rs migration is a noted follow-up).

DRY:
- render(output, value, human): one json/yaml/table dispatch replaces
  eight hand-expanded copies.
- with_spinner(): the clear-spinner-before-exit invariant lives in one
  place instead of six call sites.
- PollArgs (--wait/--wait-timeout) defined once, flattened into
  new-import/trigger-import/status; kills the too_many_arguments allow.
- CreateArgs is now the single clap definition, #[command(flatten)]-ed
  into NewConnection — the enum/struct/dispatch triple definition where
  a missed copy silently dropped a flag is gone.
- build_create_request(): the per-family flag->request mapping is pure
  and unit-tested (sql/filesystem/iceberg/rest incl. placeholder guard).
- ConnectionAdded is typed serialization instead of mutating a
  serde_json::Value (no silent null on serialization hiccups); dead
  Option<&str> params dropped from three wizard helpers; the redundant
  Connectors-local --output (shadowing the group global) removed;
  status_wait_hint() is the one place the tracking hint string lives.

Efficiency:
- catalog_list skips the active-marks registry call on session JWTs
  (the server always rejects it — previously a doomed round-trip, full
  cold-start wait included).
- pinned_connector_name uses GET /jobs/{id} (single row) instead of
  downloading the full all=true registry.

Docs: README gains the missing ingest section (commands table row +
usage, exit codes, @file/@- secrets, hd_ key requirement).

The freshest connection/import lands at the bottom of the table, next
to the prompt. json/yaml keep the server's newest-first order for
scripting.

- show-connection <id>: connection metadata (name/family/status/detail/
  database/created/updated) plus the discovered tables and column names
  from the schema-preview DB; json/yaml emit the same status+tables
  shape new-connection produces. The discovered-tables rendering is now
  shared between the two.
- delete-connection <id>: removes the registry entry and stored
  (encrypted) credentials via the worker's DELETE /ingest/sources/{id},
  then drops the schema-discovery database (reusing databases::delete;
  --keep-database opts out). The DB drop runs first so the machine ack
  is the last thing on stdout. Existing imports keep working — each
  carries its own credential copy; deleting the active onboard makes
  the next-newest onboard of that connector active.

The core skill gains an Ingest section (connections/imports model, all
commands with examples, non-blocking + status exit codes, restricted
import grammar, API-key requirement, open status vocabulary, table
ordering) plus activation phrases in the frontmatter and the top-level
command list. Ships with the next release tarball (skills install
downloads by version); stamps via cargo-release as usual.

pyiceberg's load_catalog requires the key to be named uri; the worker
passes catalog_config to it verbatim, so every wizard-created iceberg
connection failed at catalog connection. The --config path was
unaffected (keys pass through as given). Test fixtures updated to use
the correct key so they stop enshrining the wrong name.