feat(api): cancel authorized exports via loopback CLI

CHANGELOG.d/export-cancel-cli.md

@@ -0,0 +1 @@
+- `tepp-export-cancel cancel` mints naruon `POST /v1/exports/{export_id}/cancel` onto spawned `tepp-loopback` TCP (ADR 0078). Metric-free `cancelled=true` receipts only. `tepp.scientific_acceptance.v1` never appears. Does not infer causality. LineageWeave refused. `NaruonLiveService` stays POST-only. Not export collection CLI, not interpretation-run cancel CLI, not GAP-010 Figma/export, not persistence.

DOCUMENTATION.md

@@ -15,6 +15,7 @@ TEPP's approved PRD v0.4 and implementation plan are the primary product baselin
 | Orchestrator live HTTP doctoring | [`docs/research/orchestrator-live-http.md`](docs/research/orchestrator-live-http.md) |
 | Export collection GET doctoring | [`docs/research/export-collection-http.md`](docs/research/export-collection-http.md) |
 | Export cancel HTTP doctoring | [`docs/research/export-cancel-http.md`](docs/research/export-cancel-http.md) |
+| Export cancel CLI doctoring | [`docs/research/export-cancel-cli.md`](docs/research/export-cancel-cli.md) |
 | UML/runtime/scientific flows | [`docs/UML.md`](docs/UML.md) |
 | Logical/physical ERD | [`docs/ERD.md`](docs/ERD.md) |
 | Security policy | [`SECURITY.md`](SECURITY.md) |

crates/tepp_api/Cargo.toml

@@ -29,5 +29,11 @@ path = "src/bin/tepp_loopback.rs"
 test = false
 bench = false
 
+[[bin]]
+name = "tepp-export-cancel"
+path = "src/bin/tepp_export_cancel.rs"
+test = false
+bench = false
+
 [lints]
 workspace = true

crates/tepp_api/src/bin/tepp_export_cancel.rs

@@ -0,0 +1,30 @@
+//! Operator CLI for loopback naruon export cancel POST.
+
+use std::io::{self, IsTerminal};
+use std::process::ExitCode;
+
+use tepp_api::{
+    execute_export_cancel_cli, read_export_cancel_cli_stdin, render_export_cancel_cli_stdout,
+    ApiError, ExportCancelCliInvocation,
+};
+
+fn main() -> ExitCode {
+    match run() {
+        Ok(()) => ExitCode::SUCCESS,
+        Err(_) => ExitCode::FAILURE,
+    }
+}
+
+fn run() -> Result<(), ApiError> {
+    let args: Vec<String> = std::env::args().skip(1).collect();
+    let body = read_export_cancel_cli_stdin(io::stdin().is_terminal(), io::stdin())?;
+    let invocation = ExportCancelCliInvocation::from_args(&args, body)?;
+    let response = execute_export_cancel_cli(&invocation)?;
+    let stdout = render_export_cancel_cli_stdout(&invocation, &response)?;
+    println!("{stdout}");
+    if (200..300).contains(&response.status_code) {
+        Ok(())
+    } else {
+        Err(ApiError::InvalidWirePayload)
+    }
+}