feat: add user set-password, remove-role and roles commands

[NathaelB]

Summary

• user set-password <username> [--temporary] (--password <value> | --stdin) — set a user's password. --stdin is the way to avoid leaking the password into shell history / the process list; --password is kept for scripts that accept that trade-off. Exactly one of the two is required.
• user remove-role <username> <role> — remove a realm role from a user (mirrors the already-shipped assign-role).
• user roles <username> — list a user's realm roles.
• New client methods: set_user_password (PUT realms/{realm}/users/{id}/reset-password), remove_user_role (DELETE realms/{realm}/users/{id}/roles/{role_id}, mirroring the existing assign_user_role POST), list_user_roles (GET realms/{realm}/users/{id}/roles).

Issue

Refs #23 — not closing it: --client <client_id> on assign-role/remove-role (assigning a client role to a user) is still missing. I didn't want to guess that endpoint's shape (likely a doubly-nested path under both the user and the client) without a way to verify it against a running server. Left for a follow-up.

Verification

Verified live against a local FerrisKey server: created a throwaway user, ran roles (empty), assign-role + roles (shows it), remove-role + roles (empty again), set-password with --password, --temporary, and --stdin, then deleted the test fixtures. Caught and fixed one wrong assumption this way: set_user_password originally guessed PUT .../users/{id}/password (404) — the real endpoint is PUT .../users/{id}/reset-password, found via the Allow header on a 405. remove_user_role/list_user_roles worked first try, mirroring the already-correct assign_user_role/list_realm_roles shapes.

Test plan

• cargo build --workspace
• cargo test --workspace (66 passed, +6 new: password-source resolution)
• cargo clippy --workspace --all-targets --all-features -- -D warnings (matches CI, no issues)
• Manual full lifecycle test against a running FerrisKey server (see above)

[coderabbitai]

Warning

Review limit reached

Next included review available in 3 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Team

Run ID: 42627d6f-b9cd-4a80-902c-18cc8337792d

📥 Commits

Reviewing files that changed from the base of the PR and between 15eaaae and 0a19464.

📒 Files selected for processing (4)

• libs/ferriskey-cli-client/src/lib.rs
• libs/ferriskey-cli-commands/src/lib.rs
• libs/ferriskey-cli-commands/src/user.rs
• libs/ferriskey-cli-core/src/user.rs

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}