main() is one call into internal/cli (closes #160)

cmd/netwatch-server/main.go parsed the command line, ran the check-cidr
and prepare-data-dir subcommands and built the fx application itself;
the Go style guide puts all of that in internal/ or pkg/. The new
package internal/cli does it, with the same arguments, messages and
exit codes. main() is now os.Exit(cli.Main(os.Stderr, Appname, Version,
os.Args[1:], cli.RunServer)): Main takes the writer for errors and the
function that runs the server, so its tests give it a buffer and a
function that fails them. Appname and Version stay in main, where the
build sets Version. The function behind prepare-data-dir also takes the
volume and the user's name, so its own tests give it a temporary
directory and the user they run as.

Model: opus-5-5

TODO.md

@@ -22,6 +22,20 @@ Run `make frontend-viewport-test` in CI as its own step; it is not part of
 
 # Completed Steps
 
+- 2026-10-19: `main()` in `cmd/netwatch-server/main.go` is one call into a new
+  package, `internal/cli`, as the Go style guide asks
+  ([#160](https://git.eeqj.de/sneak/netwatch/issues/160)). `internal/cli` runs
+  the `check-cidr` and `prepare-data-dir` subcommands, with the same arguments,
+  messages and exit codes, and otherwise the server, with the `fx` wiring.
+  `Appname` and `Version` stay in `main`, where the build sets `Version`, and
+  `main` gives `cli.Main` stderr and the function that runs the server, which
+  the tests replace with a buffer and a function that fails them. Unit tests
+  call `cli.Main` with `check-cidr` and a CIDR the server takes and one it
+  refuses, and check the exit code and what it writes to stderr, and with
+  `prepare-data-dir` and a path outside `/data`, and check that it exits 1 with
+  the error from looking up the `netwatch` user, which the test image does not
+  have. Others give the functions behind the subcommands input they take and
+  input they refuse, and check the exit code and what they write to stderr
 - 2026-10-19: when `VERSION` is unset or empty, `script/build` stamps the
   version from `git describe --tags --always --dirty`, as `script/docker` does
   ([#156](https://git.eeqj.de/sneak/netwatch/issues/156)). Without `--tags` it