feat(cli): support vsr and enable the CLI suite under server-ng

[hubcio]

The CLI integration suite was gated off under the vsr feature, so
the iggy CLI was never exercised against server-ng. Enabling it
surfaced real gaps that this change fixes.

Un-gate the suite and add a vsr feature to iggy-cli; the
server-ng Docker image now builds with --features vsr.

Creating a topic (or partitions) with a zero partition count
aborted shard-0 on server-ng: the allocator's .expect() on the
highest consensus-group id panicked when no partitions were
assigned, taking the whole process down with SIGABRT. This was
client-triggerable. Skip the observe call when the assignment set
is empty.

The stats response hardcoded free/total disk space to 0. Resolve
both from the server's data path via fs2.

Harden the harness port reserver against a cross-process race.
RESERVED_PORTS dedups only within a process, but nextest runs
each test in its own process; concurrent 3-node startups raced for
the same ephemeral port at the release->bind window and failed with
CannotBindToSocket. Claim each port with an exclusive advisory file
lock held for the process lifetime, making the claim visible across
processes; the OS drops it on exit so a crash never leaks a port.

Recover an expired CLI login session instead of wedging. On
server-ng an expired login-session PAT returns InvalidToken (no
expiry oracle) and, on TCP/QUIC, an opaque empty reply, so the
stored session was never cleared and iggy login refused with
"already logged in" until a manual logout. iggy login now prefers
explicitly supplied credentials (other commands keep reusing the
cached token) and validates the session against the server's PAT
list, recreating it when dead; the credential delete-set is left
untouched so a transient failure never drops a valid session.

A few CLI cases are mode-split where server-ng diverges from legacy
by design: flush returns FeatureUnavailable, the session-timeout
message differs, and purge is eventually consistent so server state
is polled.

[codecov]

Codecov Report

❌ Patch coverage is 54.09836% with 28 lines in your changes missing coverage. Please review.
✅ Project coverage is 54.95%. Comparing base (313c50b) to head (1af1b2b).

Files with missing lines	Patch %	Lines
core/server-ng/src/responses.rs	0.00%	11 Missing ⚠️
core/metadata/src/impls/metadata.rs	0.00%	8 Missing ⚠️
core/cli/src/credentials.rs	66.66%	5 Missing and 2 partials ⚠️
core/cli/src/commands/binary_system/login.rs	90.90%	1 Missing ⚠️
core/server-ng/src/bootstrap.rs	0.00%	1 Missing ⚠️

Additional details and impacted files

@@              Coverage Diff              @@
##             master    #3679       +/-   ##
=============================================
- Coverage     73.98%   54.95%   -19.03%     
  Complexity      937      937               
=============================================
  Files          1301     1299        -2     
  Lines        147354   130340    -17014     
  Branches     122911   105973    -16938     
=============================================
- Hits         109013    71623    -37390     
- Misses        34868    55344    +20476     
+ Partials       3473     3373      -100     

Components	Coverage Δ
Rust Core	50.75% <54.09%> (-23.53%)	⬇️
Java SDK	62.44% <ø> (ø)
C# SDK	71.04% <ø> (-1.14%)	⬇️
Python SDK	92.17% <ø> (ø)
PHP SDK	84.29% <ø> (ø)
Node SDK	91.22% <ø> (-0.04%)	⬇️
Go SDK	42.71% <ø> (ø)

Files with missing lines	Coverage Δ
core/cli/src/commands/cli_command.rs	100.00% <100.00%> (ø)
core/cli/src/main.rs	90.52% <100.00%> (+0.16%)	⬆️
core/cli/src/commands/binary_system/login.rs	60.60% <90.90%> (+10.60%)	⬆️
core/server-ng/src/bootstrap.rs	11.17% <0.00%> (-0.01%)	⬇️
core/cli/src/credentials.rs	81.06% <66.66%> (-3.50%)	⬇️
core/metadata/src/impls/metadata.rs	50.67% <0.00%> (-0.08%)	⬇️
core/server-ng/src/responses.rs	39.76% <0.00%> (-0.21%)	⬇️

... and 324 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.