feat: add reserved --filter root value for root-level-only config

[piotrek-janus]

Summary

Adds a reserved root value to the --filter flag (pull, push, diff) that selects only root-level tenant/workspace config, excluding all nested sub-resources (clients, idps, pools, policies, schemas, themes, servers, etc.).

Previously there was no way to restrict a filter to an object's own root-level settings — users had to enumerate every root field by hand.

Behavior

• --filter root → keep only root-level fields.
• Composable with resource names: --filter root,clients → root fields plus the clients collection.
• Works at both tenant and workspace level.

cac ... pull --filter root
cac ... pull --filter root,clients
cac ... push --filter root
cac ... diff --filter root

How "root" is defined (model-derived, no maintenance)

The set of root fields is derived via reflection from the models the storage layer already serializes the root file into — smodels.Tenant for the tenant and smodels.ServerDump for a workspace (both are the config with nested dependencies stripped). --filter root keeps exactly the top-level keys defined on those models.

This means new root fields added upstream are picked up automatically — there is no hand-maintained collection/root list to keep in sync. FilterPatch takes the derived root-key set (utils.TenantRootKeys / utils.ServerRootKeys).

Not a breaking change

root was previously a no-op filter value (no resource is named root, so it matched nothing and returned an empty patch). All existing filter tokens behave identically — the root branch is only entered for the exact root token. The FilterPatch signature change is internal only.

Tests

• Extended TestFilterPatch with root-only, root+collection, tenant-context, and empty-result cases (exercising the reflection-derived key sets).
• Updated the storage tests for the new signature.
• Full suite passes; go vet and build clean.

[Copilot]

Pull request overview

This PR adds a reserved root token for the --filter flag so users can select only the root-level tenant/workspace configuration (excluding nested collections), with the root field set derived automatically from the storage-layer models.

Changes:

• Added root filtering support to FilterPatch using model-reflection-derived root key sets.
• Updated storage/client call sites for the new FilterPatch(..., rootKeys) signature.
• Extended filter tests and updated CLI help text to document --filter root usage.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
internal/cac/utils/model.go	Adds RootFilter, derives root key sets via reflection, and updates FilterPatch to support root-only selection.
internal/cac/utils/model_test.go	Extends TestFilterPatch with root-only and root+collection scenarios for tenant/workspace contexts.
internal/cac/storage/tenant_storage.go	Passes utils.TenantRootKeys into FilterPatch for tenant reads.
internal/cac/storage/tenant_storage_test.go	Updates test filtering call to pass tenant root keys.
internal/cac/storage/server_storage.go	Passes utils.ServerRootKeys into FilterPatch for workspace/server reads.
internal/cac/storage/server_storage_test.go	Updates test filtering call to pass server root keys.
internal/cac/client/tenant_client.go	Passes utils.TenantRootKeys into FilterPatch for tenant client reads.
internal/cac/client/client.go	Passes utils.ServerRootKeys into FilterPatch for workspace client reads.
cmd/push.go	Documents --filter root and --filter root,clients in CLI help text.
cmd/pull.go	Documents --filter root and --filter root,clients in CLI help text.
cmd/diff.go	Documents --filter root and --filter root,clients in CLI help text.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.