mr-668: CLI omnigraph graphs list/create (PR 8/10)

PR 8 of the MR-668 multi-graph server work. CLI parity for the
v0.7.0 management surface: operators can now manage graphs from
the command line against a running multi-graph server.

  omnigraph graphs list --target dev --json
  omnigraph graphs create \
    --target dev \
    --graph-id beta \
    --graph-uri /data/beta.omni \
    --schema schema.pg

DELETE is intentionally absent — server-side DELETE was deferred from
v0.7.0 scope, and shipping a client subcommand for a server endpoint
that doesn't exist would be dead vocabulary. The help output, the
subcommand enum, and the test that pins it (`graphs_subcommand_help_
lists_list_and_create`) all agree.

CLI architecture (modeled on `BranchCommand`):
  - New `Command::Graphs { command: GraphsCommand }` top-level variant.
  - `GraphsCommand { List, Create }` enum.
  - List: GET `<base>/graphs`. Stdout is `<graph_id>\t<uri>` per line,
    or JSON via `--json`.
  - Create: reads `--schema <path>` from local disk, inlines as
    `schema: { source: <file> }` in the POST body (nested per
    MR-668 decision 7). Optional `--policy-file <path>` becomes
    `policy: { file: <path> }`. Returns 201 → "created graph X at Y"
    or JSON via `--json`.
  - Both subcommands reject local URI targets with a clear
    "remote multi-graph server URL" error.

New API type imports in the CLI: `GraphCreateRequest`,
`GraphCreateResponse`, `GraphListResponse`, `GraphSchemaSpec`,
`GraphPolicySpec` — all from `omnigraph-server::api`.

Tests:
  - cli.rs (4 new, non-network):
      * `graphs_subcommand_help_lists_list_and_create` — pins the
        deferral of `delete` (catches scope creep).
      * `graphs_list_against_local_uri_errors_with_remote_only_message`
      * `graphs_create_against_local_uri_errors_with_remote_only_message`
      * `graphs_create_with_missing_schema_file_errors` — pins the
        IO context in the schema-read error path.
  - system_remote.rs (1 new, `#[ignore]` like its peers):
      * `graphs_list_and_create_against_multi_graph_server` — spawns a
        multi-mode server, calls `graphs list` (sees `alpha`),
        `graphs create` (adds `beta`), `graphs list` again (sees both),
        and confirms the new graph is reachable via its cluster route.

CLI suite: 62 tests green (58 existing + 4 new). The new ignored
end-to-end test runs locally with `cargo test --ignored`.

LOC: +159 main.rs (enum + handlers), +88 cli.rs (unit tests),
+131 system_remote.rs (integration test).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

crates/omnigraph-cli/tests/cli.rs

@@ -2040,3 +2040,91 @@ fn schema_plan_parity_cli_and_sdk() {
     );
     assert_eq!(cli_payload["supported"], plan.supported);
 }
+
+// ─── MR-668 PR 8 — omnigraph graphs subcommand ─────────────────────────────
+
+/// `omnigraph graphs --help` lists the two subcommands shipped in
+/// v0.7.0 (`list`, `create`). `delete` is intentionally NOT in the
+/// help — DELETE was deferred to bound the v0.7.0 scope.
+#[test]
+fn graphs_subcommand_help_lists_list_and_create() {
+    let output = output_success(cli().arg("graphs").arg("--help"));
+    let stdout = stdout_string(&output);
+    assert!(
+        stdout.contains("list"),
+        "expected `list` subcommand in help output:\n{stdout}"
+    );
+    assert!(
+        stdout.contains("create"),
+        "expected `create` subcommand in help output:\n{stdout}"
+    );
+    // Pin the deferral: `delete` must not appear yet (catches an
+    // accidental scope expansion).
+    assert!(
+        !stdout.to_lowercase().contains("delete a graph"),
+        "graph delete should not be in v0.7.0 help; got:\n{stdout}"
+    );
+}
+
+/// `omnigraph graphs list` against a local URI errors with a clear
+/// message — the CLI only operates against remote multi-graph servers.
+#[test]
+fn graphs_list_against_local_uri_errors_with_remote_only_message() {
+    let output = output_failure(cli().arg("graphs").arg("list").arg("--uri").arg("/tmp/local"));
+    let stderr = String::from_utf8_lossy(&output.stderr).into_owned();
+    assert!(
+        stderr.contains("remote multi-graph server URL"),
+        "expected 'remote multi-graph server URL' rejection in stderr; got:\n{stderr}"
+    );
+}
+
+/// `omnigraph graphs create` against a local URI errors the same way.
+#[test]
+fn graphs_create_against_local_uri_errors_with_remote_only_message() {
+    let temp = tempdir().unwrap();
+    let schema = temp.path().join("schema.pg");
+    fs::write(&schema, "node Person { name: String @key }\n").unwrap();
+    let output = output_failure(
+        cli()
+            .arg("graphs")
+            .arg("create")
+            .arg("--uri")
+            .arg("/tmp/local")
+            .arg("--graph-id")
+            .arg("alpha")
+            .arg("--graph-uri")
+            .arg("/tmp/alpha.omni")
+            .arg("--schema")
+            .arg(&schema),
+    );
+    let stderr = String::from_utf8_lossy(&output.stderr).into_owned();
+    assert!(
+        stderr.contains("remote multi-graph server URL"),
+        "expected 'remote multi-graph server URL' rejection in stderr; got:\n{stderr}"
+    );
+}
+
+/// `omnigraph graphs create` with a missing `--schema` file errors
+/// with the IO context. Catches a regression where the CLI silently
+/// sent an empty body.
+#[test]
+fn graphs_create_with_missing_schema_file_errors() {
+    let output = output_failure(
+        cli()
+            .arg("graphs")
+            .arg("create")
+            .arg("--uri")
+            .arg("http://127.0.0.1:0")
+            .arg("--graph-id")
+            .arg("alpha")
+            .arg("--graph-uri")
+            .arg("/tmp/alpha.omni")
+            .arg("--schema")
+            .arg("/this/path/does/not/exist.pg"),
+    );
+    let stderr = String::from_utf8_lossy(&output.stderr).into_owned();
+    assert!(
+        stderr.contains("reading schema file"),
+        "expected 'reading schema file' error in stderr; got:\n{stderr}"
+    );
+}