main() is one call into internal/cli (closes #160)

cmd/netwatch-server/main.go parsed the command line, ran the check-cidr
and prepare-data-dir subcommands and built the fx application itself;
the Go style guide puts all of that in internal/ or pkg/. The new
package internal/cli does it, with the same arguments, messages and
exit codes, and main() is now os.Exit(cli.Main(Appname, Version,
os.Args[1:])). Appname and Version stay in main, where the build sets
Version. Each subcommand writes its error to a writer it is given, and
prepare-data-dir also takes the volume and the user's name, so the new
unit tests give it a temporary directory and the user they run as.

Model: opus-5-5

TODO.md

@@ -21,6 +21,14 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
 
 # Completed Steps
 
+- 2026-10-19: `main()` in `cmd/netwatch-server/main.go` is one call into a new
+  package, `internal/cli`, as the Go style guide asks
+  ([#160](https://git.eeqj.de/sneak/netwatch/issues/160)). `internal/cli` runs
+  the `check-cidr` and `prepare-data-dir` subcommands, with the same arguments,
+  messages and exit codes, and otherwise the server, with the `fx` wiring.
+  `Appname` and `Version` stay in `main`, where the build sets `Version`. Unit
+  tests give each subcommand input it takes and input it refuses, and check the
+  exit code and what it writes to stderr
 - 2026-10-19: report file writes no longer overlap
   ([#150](https://git.eeqj.de/sneak/netwatch/issues/150)), so the reports of
   failed writes are written in the order they arrived. Two writes that failed at