fix: add missing cmd/ (gitignore was excluding source dirs)

The initial commit's .gitignore had unanchored 'encapi' and 'encapi-cli'
patterns intended for built binaries; they also matched the cmd/encapi and
cmd/encapi-cli source directories, so those were silently never committed. The
tag build then failed with 'stat /build/cmd/encapi: directory not found'.

- anchor the binary ignores to the repo root (/encapi, /encapi-cli)
- add the cmd/encapi (server) and cmd/encapi-cli (CLI) main packages

.gitignore

@@ -2,5 +2,7 @@
 /dist/
 *.rpm
 *.zip
-encapi
+# Root-level dev binaries only — anchored so cmd/encapi and cmd/encapi-cli
-encapi-cli
+# (the source packages) are NOT ignored.
+/encapi
+/encapi-cli

cmd/encapi-cli/main.go

@@ -0,0 +1,13 @@
+// Command encapi-cli manages the Puppet ENC via the encapi HTTP API. Puppet's
+// exec node_terminus calls `encapi-cli classify <certname>`.
+package main
+
+import (
+	"os"
+
+	"git.unkin.net/unkin/encapi/internal/cli"
+)
+
+func main() {
+	os.Exit(cli.Run(os.Args[1:], cli.LoadEnv(), os.Stdout, os.Stderr))
+}

cmd/encapi/main.go

@@ -0,0 +1,50 @@
+// Command encapi is the ENC HTTP server: it serves Puppet's node classification
+// documents and the read/write API backing the CLI and Terraform provider.
+package main
+
+import (
+	"context"
+	"log/slog"
+	"os"
+	"os/signal"
+	"syscall"
+
+	"git.unkin.net/unkin/encapi/internal/config"
+	"git.unkin.net/unkin/encapi/internal/database"
+	"git.unkin.net/unkin/encapi/internal/distro"
+	"git.unkin.net/unkin/encapi/internal/server"
+)
+
+var version = "dev"
+
+func main() {
+	slog.SetDefault(slog.New(slog.NewJSONHandler(os.Stdout, nil)))
+	slog.Info("starting encapi", "version", version)
+
+	cfg, err := config.Load()
+	if err != nil {
+		slog.Error("load config", "err", err)
+		os.Exit(1)
+	}
+
+	db, err := database.New(cfg.DatabaseDSN())
+	if err != nil {
+		slog.Error("connect database", "err", err)
+		os.Exit(1)
+	}
+	defer db.Close()
+
+	if cfg.WriteToken == "" {
+		slog.Warn("ENCAPI_WRITE_TOKEN is not set; write endpoints are disabled")
+	}
+
+	srv := server.New(db, distro.New(cfg.DistroAPIURL), cfg.WriteToken)
+
+	ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGINT, syscall.SIGTERM)
+	defer stop()
+
+	if err := srv.ListenAndServe(ctx, cfg.ListenAddr); err != nil {
+		slog.Error("server", "err", err)
+		os.Exit(1)
+	}
+}