Add defang identity: agent public-key registration

[defangdevs]

Draft implementation for #2166 — CLI half of the agent-identity key registry (DefangLabs/openauth PR 8): agents hold a local keypair and register only the public half with the per-tenant OIDC registry, then federate into clouds with self-signed JWTs instead of long-lived credentials.

What's added

• defang identity register — generates an RS256 keypair on first use (private key stays in <state-dir>/identity/<tenant>/<project>/<stack>/private.pem, mode 0600, one key per pair because the registry rejects cross-stack key reuse), signs the proof-of-possession JWT, and POSTs the public JWK to https://<tenant>.<issuer-host>/keys. Project and stack come from the normal session machinery (no cloud-provider auth needed, so CheckAccountInfo is off); the bearer is the OpenAuth token saved by defang login; the issuer comes from DEFANG_ISSUER.
• defang identity list / defang identity revoke KID — the GET/DELETE endpoints.
• pkg/identity — keypair handling (RS256: AWS OIDC federation doesn't accept Ed25519) and the registry HTTP client. RFC 7638 thumbprint via go-jose (promoted indirect → direct; no new deps), PoP JWT via the existing golang-jwt/v5.
• pkg/http/delete.go — DeleteWithHeader/DeleteWithAuth, mirroring the existing GET helpers.
• auth.Client.Issuer() accessor so the tenant URL can be derived without re-reading the env var.

Verification

• go test -short ./... green; golangci-lint run clean on all touched packages.
• Live end-to-end against the spike registry (tenant1.auth-spike.nixos.defang.ca): register → kid/sub returned, idempotent re-register, same-key-different-stack rejected with 409, list, revoke — all through the new pkg/identity client.

Why draft

Gated on the openauth side: PR 8 landing and the tenant-enabled issuer being deployed at auth.defang.io. Open questions from #2166 also apply (should /keys require a scoped token rather than the plain login token; identity rotate convenience).

🤖 Generated with Claude Code

https://claude.ai/code/session_01R9PbZ9nkj1RxubjnxujXPa

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 7204e5d1-68d5-41ba-9978-8ea35e850e85

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}