feat: close network/server flag-parity gaps found by a cleanup script

[ftarasenko]

Closes the koc/openstack flag gaps that a real cleanup script hit. Each gap forced a separate code path in the script, and one of them silently skipped every router. All flag names and behaviour were checked against python-openstackclient 10.3.0's parsers.

Changes

router list (internal/cli/network/router.go)

• New flags: --project/--project-domain, --enable/--disable, --tags/--any-tags/--not-tags/--not-any-tags, --long, --agent <id>. Before this, the only flag was --name, so --project failed with a usage error (exit 2).
• Distributed and HA columns appear whenever neutron returns those fields, which matches upstream (neutron only returns them to admins). --long adds Routes, External gateway info, Availability zones (only when the router_availability_zone extension reports them) and Tags.
• --agent lists the routers from /agents/{id}/l3-routers. That endpoint accepts no query filters, so the other filters are applied client-side.

router show: adds upstream's interfaces_info, built the same way upstream builds it: list the router's ports by device_id, skip the gateway port, and add one entry per fixed IP.

security group list (internal/cli/network/securitygroup.go)

• New flags: --project/--project-domain, the four tag filters, --share/--no-share, plus an exact --name that is koc-only (upstream has no name filter). Before this there were no filters at all.
• Adds upstream's Tags and Shared columns.
• gophercloud's groups.List has no shared option and no ExtractGroupsInto, so the pager is built in a small separate helper (listSecGroups).

--all-projects on both list verbs is a koc-only no-op that honours ALL_PROJECTS and is refused with --project. It works like the existing port list one: neutron has no cross-project switch, and both tables already show Project. It exists so a script that passes it gets a listing instead of a usage error.

server delete (internal/cli/server/server.go, state.go)

• --wait/--wait-timeout sends every DELETE first, then polls each server until nova returns 404, and prints Deleted server X only after that.
• A SOFT_DELETED server fails the wait immediately and suggests --force, rather than waiting until the timeout while the server still holds its ports.
• --force sends nova's forceDelete action, as upstream does.

Docs: docs/coverage.md and the README "Known limitations" section now cover the new koc-only flags. The command count doesn't change: no commands were added or removed.

Deliberately not changed: -f value keeps its tab separator. docs/coverage.md records that as a deliberate deviation, and changing it needs a separate decision.

Verification

• go test ./..., go vet, golangci-lint v2.13.2 (the version CI pins): 0 issues. gofmt is clean, and the offline static build (-mod=vendor, GOPROXY=off) succeeds.
• New tests: the full query string for every filter, interfaces_info shape and key order, column presence rules for --long and admin-only fields, client-side filtering for --agent, --share/--no-share, server delete --wait (all DELETEs before any polling, confirmation only after 404), fail-fast on SOFT_DELETED, and --force sending only the action.
• Ran the built koc end-to-end against a local mock of keystone, neutron and nova, and checked the request log for each new flag. Not run against a real cloud.

🤖 Generated with Claude Code

https://claude.ai/code/session_01RCegCom2HEfpHM4H58tBfa

---

Generated by Claude Code