feat: add 40+ new command groups and comprehensive test suite

New command groups (all with full output_options support):
- Identity: user, project, domain, role, group, credential,
  application_credential, access_rule, trust, federation, token,
  endpoint, endpoint_group, region, service, policy, limit
- Compute: aggregate, availability_zone, compute_service, hypervisor,
  server_group, event, usage
- Volume: backup (Freezer), object_store, stack (Heat)
- Network: qos_policy, subnet_pool, trunk
- DNS: zone, recordset
- Placement: resource_class, resource_provider, trait, inventory, usage
- Metric: (Gnocchi) resource, measure, archive_policy
- Alarm: (Aodh) alarm CRUD
- Auth: auth show, token issue

New orca-exclusive commands:
- overview: real-time project dashboard
- watch: live refresh dashboard
- doctor: pre-deployment health check
- audit: security audit (open SGs, unencrypted volumes, orphaned FIPs)
- cleanup: orphaned resource detection
- export: infra snapshot to YAML/JSON
- ip whois: resolve IP to owning resource
- profile: multi-account management (add/edit/remove/switch,
  from-clouds, to-clouds, from-openrc, to-openrc, set-color, regions)
- limits: unified quota view across services
- quota: set quotas per project

Bug fixes:
- stack: resolve via list endpoint to avoid 302; stringify yaml dates
- volume set-bootable/set-readonly: positional → flag
- volume snapshot-create: accept name or UUID
- volume backup-create: GET after POST for full details
- object_store container-delete: add --yes guard
- loadbalancer delete: catch 409 with helpful message
- metric resource-list: default limit=100
- placement: add OpenStack-API-Version header
- doctor: use /networks?limit=1 for Neutron reachability check

OSC gap closures:
- aggregate unset, aggregate cache-image
- server migration-abort, migration-force-complete
- volume attachment-create/set/complete
- volume group-snapshot CRUD, group-type CRUD
- network segment CRUD, auto-allocated-topology show/delete

Author: kallioli

.gitignore

@@ -12,3 +12,4 @@ build/
 .pytest_cache/
 .ruff_cache/
 site/
+CLAUDE.md

orca_cli/commands/access_rule.py

@@ -0,0 +1,95 @@
+"""``orca access-rule`` — manage application credential access rules (Keystone)."""
+
+from __future__ import annotations
+
+import click
+
+from orca_cli.core.context import OrcaContext
+from orca_cli.core.output import console, output_options, print_detail, print_list
+from orca_cli.core.validators import validate_id
+
+
+def _iam(client) -> str:
+    return client.identity_url
+
+
+@click.group("access-rule")
+@click.pass_context
+def access_rule(ctx: click.Context) -> None:
+    """Manage application credential access rules (Keystone)."""
+
+
+@access_rule.command("list")
+@click.option("--user-id", default=None, callback=validate_id,
+              help="User ID (defaults to current user).")
+@click.option("--service", default=None, help="Filter by service type (e.g. compute).")
+@click.option("--method", default=None, help="Filter by HTTP method.")
+@click.option("--path", default=None, help="Filter by API path.")
+@output_options
+@click.pass_context
+def ar_list(ctx, user_id, service, method, path,
+            output_format, columns, fit_width, max_width, noindent):
+    """List access rules."""
+    client = ctx.find_object(OrcaContext).ensure_client()
+    uid = user_id or client._token_data.get("user", {}).get("id", "")  # type: ignore[attr-defined]
+    params = {}
+    if service:
+        params["service"] = service
+    if method:
+        params["method"] = method
+    if path:
+        params["path"] = path
+    data = client.get(f"{_iam(client)}/v3/users/{uid}/access_rules", params=params)
+    items = data.get("access_rules", [])
+    if not items:
+        console.print("No access rules found.")
+        return
+    col_defs = [
+        ("ID", "id"),
+        ("Service", "service"),
+        ("Method", "method"),
+        ("Path", "path"),
+    ]
+    print_list(items, col_defs, title="Access Rules",
+               output_format=output_format, columns=columns,
+               fit_width=fit_width, max_width=max_width, noindent=noindent)
+
+
+@access_rule.command("show")
+@click.argument("access_rule_id", callback=validate_id)
+@click.option("--user-id", default=None, callback=validate_id,
+              help="User ID (defaults to current user).")
+@output_options
+@click.pass_context
+def ar_show(ctx, access_rule_id, user_id,
+            output_format, columns, fit_width, max_width, noindent):
+    """Show an access rule."""
+    client = ctx.find_object(OrcaContext).ensure_client()
+    uid = user_id or client._token_data.get("user", {}).get("id", "")  # type: ignore[attr-defined]
+    data = client.get(f"{_iam(client)}/v3/users/{uid}/access_rules/{access_rule_id}")
+    ar = data.get("access_rule", data)
+    fields = [
+        ("ID", ar.get("id", "")),
+        ("Service", ar.get("service", "")),
+        ("Method", ar.get("method", "")),
+        ("Path", ar.get("path", "")),
+    ]
+    print_detail(fields,
+                 output_format=output_format, columns=columns,
+                 fit_width=fit_width, max_width=max_width, noindent=noindent)
+
+
+@access_rule.command("delete")
+@click.argument("access_rule_id", callback=validate_id)
+@click.option("--user-id", default=None, callback=validate_id,
+              help="User ID (defaults to current user).")
+@click.option("--yes", "-y", is_flag=True)
+@click.pass_context
+def ar_delete(ctx, access_rule_id, user_id, yes):
+    """Delete an access rule."""
+    client = ctx.find_object(OrcaContext).ensure_client()
+    uid = user_id or client._token_data.get("user", {}).get("id", "")  # type: ignore[attr-defined]
+    if not yes:
+        click.confirm(f"Delete access rule {access_rule_id}?", abort=True)
+    client.delete(f"{_iam(client)}/v3/users/{uid}/access_rules/{access_rule_id}")
+    console.print(f"Access rule [bold]{access_rule_id}[/bold] deleted.")

orca_cli/commands/aggregate.py

@@ -0,0 +1,190 @@
+"""``orca aggregate`` — manage host aggregates (Nova)."""
+
+from __future__ import annotations
+
+import click
+
+from orca_cli.core.context import OrcaContext
+from orca_cli.core.output import output_options, print_list, print_detail, console
+
+
+def _nova(client) -> str:
+    return client.compute_url
+
+
+@click.group()
+@click.pass_context
+def aggregate(ctx: click.Context) -> None:
+    """Manage host aggregates (Nova)."""
+    pass
+
+
+@aggregate.command("list")
+@output_options
+@click.pass_context
+def aggregate_list(ctx, output_format, columns, fit_width, max_width, noindent):
+    """List host aggregates."""
+    client = ctx.find_object(OrcaContext).ensure_client()
+    data = client.get(f"{_nova(client)}/os-aggregates")
+    print_list(
+        data.get("aggregates", []),
+        [
+            ("ID", "id", {"style": "cyan"}),
+            ("Name", "name", {"style": "bold"}),
+            ("AZ", lambda a: a.get("availability_zone") or "—"),
+            ("Hosts", lambda a: str(len(a.get("hosts", [])))),
+            ("Metadata", lambda a: ", ".join(f"{k}={v}" for k, v in (a.get("metadata") or {}).items()) or "—"),
+        ],
+        title="Host Aggregates",
+        output_format=output_format, columns=columns,
+        fit_width=fit_width, max_width=max_width, noindent=noindent,
+        empty_msg="No aggregates found.",
+    )
+
+
+@aggregate.command("show")
+@click.argument("aggregate_id")
+@output_options
+@click.pass_context
+def aggregate_show(ctx, aggregate_id, output_format, columns, fit_width, max_width, noindent):
+    """Show aggregate details."""
+    client = ctx.find_object(OrcaContext).ensure_client()
+    data = client.get(f"{_nova(client)}/os-aggregates/{aggregate_id}")
+    a = data.get("aggregate", data)
+    print_detail(
+        [
+            ("ID", str(a.get("id", ""))),
+            ("Name", a.get("name", "")),
+            ("Availability Zone", a.get("availability_zone") or "—"),
+            ("Hosts", ", ".join(a.get("hosts", [])) or "—"),
+            ("Metadata", ", ".join(f"{k}={v}" for k, v in (a.get("metadata") or {}).items()) or "—"),
+            ("Created", a.get("created_at", "")),
+            ("Updated", a.get("updated_at") or "—"),
+        ],
+        output_format=output_format, columns=columns,
+        fit_width=fit_width, max_width=max_width, noindent=noindent,
+    )
+
+
+@aggregate.command("create")
+@click.argument("name")
+@click.option("--zone", "availability_zone", default=None, help="Availability zone name.")
+@click.pass_context
+def aggregate_create(ctx, name, availability_zone):
+    """Create a host aggregate."""
+    client = ctx.find_object(OrcaContext).ensure_client()
+    body: dict = {"name": name}
+    if availability_zone:
+        body["availability_zone"] = availability_zone
+    data = client.post(f"{_nova(client)}/os-aggregates", json={"aggregate": body})
+    a = data.get("aggregate", data)
+    console.print(f"[green]Aggregate '{a.get('name')}' ({a.get('id')}) created.[/green]")
+
+
+@aggregate.command("delete")
+@click.argument("aggregate_id")
+@click.option("--yes", "-y", is_flag=True)
+@click.pass_context
+def aggregate_delete(ctx, aggregate_id, yes):
+    """Delete a host aggregate."""
+    if not yes:
+        click.confirm(f"Delete aggregate {aggregate_id}?", abort=True)
+    client = ctx.find_object(OrcaContext).ensure_client()
+    client.delete(f"{_nova(client)}/os-aggregates/{aggregate_id}")
+    console.print(f"[green]Aggregate {aggregate_id} deleted.[/green]")
+
+
+@aggregate.command("add-host")
+@click.argument("aggregate_id")
+@click.argument("host")
+@click.pass_context
+def aggregate_add_host(ctx, aggregate_id, host):
+    """Add a host to an aggregate."""
+    client = ctx.find_object(OrcaContext).ensure_client()
+    client.post(f"{_nova(client)}/os-aggregates/{aggregate_id}/action",
+                json={"add_host": {"host": host}})
+    console.print(f"[green]Host '{host}' added to aggregate {aggregate_id}.[/green]")
+
+
+@aggregate.command("remove-host")
+@click.argument("aggregate_id")
+@click.argument("host")
+@click.pass_context
+def aggregate_remove_host(ctx, aggregate_id, host):
+    """Remove a host from an aggregate."""
+    client = ctx.find_object(OrcaContext).ensure_client()
+    client.post(f"{_nova(client)}/os-aggregates/{aggregate_id}/action",
+                json={"remove_host": {"host": host}})
+    console.print(f"[green]Host '{host}' removed from aggregate {aggregate_id}.[/green]")
+
+
+@aggregate.command("set")
+@click.argument("aggregate_id")
+@click.option("--name", default=None, help="New name.")
+@click.option("--zone", "availability_zone", default=None, help="New availability zone.")
+@click.option("--property", "properties", multiple=True, metavar="KEY=VALUE",
+              help="Metadata key=value (repeatable).")
+@click.pass_context
+def aggregate_set(ctx, aggregate_id, name, availability_zone, properties):
+    """Update an aggregate's name, AZ, or metadata."""
+    client = ctx.find_object(OrcaContext).ensure_client()
+    body: dict = {}
+    if name:
+        body["name"] = name
+    if availability_zone:
+        body["availability_zone"] = availability_zone
+
+    if body:
+        client.put(f"{_nova(client)}/os-aggregates/{aggregate_id}",
+                   json={"aggregate": body})
+
+    if properties:
+        meta = {}
+        for prop in properties:
+            if "=" not in prop:
+                raise click.UsageError(f"Invalid format '{prop}', expected KEY=VALUE.")
+            k, v = prop.split("=", 1)
+            meta[k] = v
+        client.post(f"{_nova(client)}/os-aggregates/{aggregate_id}/action",
+                    json={"set_metadata": {"metadata": meta}})
+
+    if not body and not properties:
+        console.print("[yellow]Nothing to update.[/yellow]")
+        return
+    console.print(f"[green]Aggregate {aggregate_id} updated.[/green]")
+
+
+@aggregate.command("unset")
+@click.argument("aggregate_id")
+@click.option("--property", "properties", multiple=True, metavar="KEY",
+              help="Metadata key to remove (repeatable).")
+@click.pass_context
+def aggregate_unset(ctx, aggregate_id, properties):
+    """Unset metadata properties on an aggregate."""
+    if not properties:
+        console.print("[yellow]Nothing to unset.[/yellow]")
+        return
+    client = ctx.find_object(OrcaContext).ensure_client()
+    # Setting a key to None removes it from the aggregate metadata
+    meta = {k: None for k in properties}
+    client.post(f"{_nova(client)}/os-aggregates/{aggregate_id}/action",
+                json={"set_metadata": {"metadata": meta}})
+    console.print(f"[green]Aggregate {aggregate_id} properties removed.[/green]")
+
+
+@aggregate.command("cache-image")
+@click.argument("aggregate_id")
+@click.argument("image_ids", nargs=-1, required=True)
+@click.pass_context
+def aggregate_cache_image(ctx, aggregate_id, image_ids):
+    """Request that images be cached on hosts in an aggregate.
+
+    \b
+    Examples:
+      orca aggregate cache-image <agg-id> <image-id>
+      orca aggregate cache-image <agg-id> <img1> <img2>
+    """
+    client = ctx.find_object(OrcaContext).ensure_client()
+    client.post(f"{_nova(client)}/os-aggregates/{aggregate_id}/images",
+                json={"cache": [{"id": iid} for iid in image_ids]})
+    console.print(f"[green]Image caching requested on aggregate {aggregate_id}.[/green]")