feat: add admin orphan-report and orphan-confirm commands

Implements two new upstream endpoints:
- GET /api/v2/admin/orphans/report → `zad admin orphan-report`
- POST /api/v2/admin/orphans/confirm → `zad admin orphan-confirm`

The report command is read-only and shows the classified orphan sweep.
The confirm command marks selected items for grace-period deletion via
repeatable --item TYPE:NAME (or TYPE:NAME:REALM for keycloak_client).

Author: github-actions[bot]

src/zad_cli/api/client.py

@@ -413,6 +413,16 @@ def delete_admin_mark(self, mark_id: str) -> dict:
         """Remove a specific deletion mark without purging the resource."""
         return self._async_request("DELETE", f"/v2/admin/marked-for-deletion/{mark_id}")
 
+    def get_orphan_report(self) -> dict:
+        """Run the orphan sweep and return the classification report."""
+        response = self._request("GET", "/v2/admin/orphans/report")
+        return response.json()
+
+    def confirm_orphans(self, payload: dict) -> dict:
+        """Mark confirmed orphan candidates for grace-period deletion."""
+        response = self._request("POST", "/v2/admin/orphans/confirm", json=payload)
+        return response.json()
+
     # --- Metrics ---
 
     def health(self) -> dict:

src/zad_cli/commands/admin.py

@@ -1,7 +1,9 @@
-"""Admin commands: list, delete."""
+"""Admin commands: list, delete, orphan-report, orphan-confirm."""
 
 from __future__ import annotations
 
+from typing import Annotated
+
 import typer
 
 from zad_cli.helpers import confirm_action, get_helpers, handle_api_errors, render_dry_run
@@ -60,3 +62,74 @@ def delete(
     result = client.delete_admin_mark(mark_id)
     formatter.render(result)
     formatter.render_success(f"Deletion mark '{mark_id}' removed.")
+
+
+@app.command("orphan-report")
+@handle_api_errors
+def orphan_report(ctx: typer.Context) -> None:
+    """Show the orphan sweep report (read-only).
+
+    Inventories PostgreSQL databases, Keycloak realms/clients and MinIO
+    buckets, classified against live project files. Performs zero mutations.
+    To mark orphans for deletion, use [bold]zad admin orphan-confirm[/bold].
+
+    [bold]Example:[/bold]
+
+        $ zad admin orphan-report
+    """
+    client, formatter = get_helpers(ctx)
+    result = client.get_orphan_report()
+    formatter.render(result)
+
+
+@app.command("orphan-confirm")
+@handle_api_errors
+def orphan_confirm(
+    ctx: typer.Context,
+    items: Annotated[
+        list[str] | None,
+        typer.Option("--item", help="Item to confirm as TYPE:NAME or TYPE:NAME:REALM, repeatable"),
+    ] = None,
+    yes: bool = typer.Option(False, "--yes", "-y", help="Skip confirmation"),
+    dry_run: bool = typer.Option(False, "--dry-run", help="Show what would be sent without making the API call"),
+) -> None:
+    """Mark confirmed orphan candidates for grace-period deletion.
+
+    Each item is specified as TYPE:NAME (or TYPE:NAME:REALM for keycloak_client).
+    Valid types: postgresql_database, postgresql_user, minio_bucket, keycloak_client.
+
+    Run [bold]zad admin orphan-report[/bold] first to see candidates.
+
+    [bold]Example:[/bold]
+
+        $ zad admin orphan-confirm --item postgresql_database:regel_k4c_pr104
+        $ zad admin orphan-confirm --item minio_bucket:old-bucket --item postgresql_user:stale_user
+    """
+    client, formatter = get_helpers(ctx)
+
+    if not items:
+        formatter.render_error("At least one --item is required.")
+        raise typer.Exit(1)
+
+    parsed: list[dict] = []
+    for raw in items:
+        parts = raw.split(":", 2)
+        if len(parts) < 2:
+            formatter.render_error(f"Invalid item format '{raw}'. Expected TYPE:NAME or TYPE:NAME:REALM.")
+            raise typer.Exit(1)
+        entry: dict = {"type": parts[0], "name": parts[1]}
+        if len(parts) == 3:
+            entry["realm"] = parts[2]
+        parsed.append(entry)
+
+    payload = {"items": parsed}
+
+    if dry_run:
+        render_dry_run(formatter, "POST", "/v2/admin/orphans/confirm", payload)
+        return
+
+    confirm_action(f"Mark {len(parsed)} orphan(s) for grace-period deletion?", yes)
+
+    result = client.confirm_orphans(payload)
+    formatter.render(result)
+    formatter.render_success(f"Confirmed {len(parsed)} orphan(s) for deletion.")

tests/test_backwards_compat.py

@@ -99,7 +99,7 @@ def run_help(*args: str) -> subprocess.CompletedProcess:
     "metrics": ["health", "overview", "cpu", "memory", "pods", "network", "query"],
     "config": ["init", "set", "get", "list", "path"],
     "open": ["project", "portal", "domains"],
-    "admin": ["list", "delete"],
+    "admin": ["list", "delete", "orphan-report", "orphan-confirm"],
 }
 
 
@@ -126,7 +126,9 @@ def test_cli_commands_not_removed():
     "add_component_to_deployment",
     "add_service",
     "backup_bucket",
+    "confirm_orphans",
     "delete_admin_mark",
+    "get_orphan_report",
     "backup_database",
     "backup_namespace",
     "backup_project",
@@ -198,7 +200,9 @@ def test_client_public_methods_not_removed():
 # Changing these would break callers that pass arguments positionally.
 EXPECTED_METHOD_MIN_ARGS: dict[str, int] = {
     "add_component": 2,
+    "confirm_orphans": 1,
     "delete_admin_mark": 1,
+    "get_orphan_report": 0,
     "list_admin_marked": 0,
     "list_pvc_snapshots": 3,
     "restore_deployment_resource": 3,