feat(client): let the CLI authenticate against a gateway in front of n8n

[syucream]

Problem

Client.doRequest sends a fixed set of headers — X-N8N-API-KEY, Content-Type, Accept. There is no seam to attach anything else, so pointing N8N_API_URL at a gateway that authenticates callers per request fails at the edge:

$ N8N_API_URL=<gateway> N8N_API_KEY=dummy n8n-cli workflow list --limit 2
Error: Unexpected error (status 403)

The credential never reaches the gateway, and n8n is never involved. That leaves two bad options: bypass the gateway, or run a local relay process whose only job is to add two headers. Both defeat the purpose of deploying the gateway.

Changes

• Client takes an egress middleware chain, wired from N8N_CLIENT_MIDDLEWARES. These are the same ClientMiddlewares the proxy subcommand already runs on its own egress, so there is one implementation and one config vocabulary for both directions. Empty by default — the direct-to-n8n path is byte-identical to before.
• New iap-auth token source adc-impersonate: mints the id_token as a target service account using local Application Default Credentials (ADC refresh-token grant → iamcredentials.generateIdToken). The metadata source only covers workloads; a developer machine previously had no way to produce that token except pasting gcloud auth print-identity-token --impersonate-service-account=... into an env var every hour.
• Audience derivation instead of a required constant. impersonator-token's audience is now optional: the ADC source names its own, because the refresh-token grant only issues tokens for the client that owns the credentials — asking for a different project's client fails outright with invalid_audience. A configured constant that doesn't match the credentials in use fails at the far end with nothing but "verification failed", which is a miserable thing to debug. iap-auth likewise defaults its audience to the API URL, which is what a Cloud Run gateway expects.
• N8N_API_KEY is optional when an egress chain is configured. A gateway that terminates authentication holds the n8n key and injects it upstream, so the caller has none; demanding one anyway pushes operators to park a placeholder — or the real shared key — in every developer's shell.
• Accept-Encoding: identity on API requests. A proxy commonly re-emits the upstream's Content-Encoding over a body its own HTTP client already decoded, and that mismatch arrives here as an unrecoverable decompression failure. Uncompressed transfers cost bandwidth a CLI can afford; a read path that dies on large responses is not affordable.

Resulting setup — no relay process, no manual token step:

export N8N_API_URL="https://gateway.example.com"
export N8N_CLIENT_MIDDLEWARES="iap-auth,impersonator-token"
export N8N_IAP_AUTH_TOKEN_SOURCE="adc-impersonate"
export N8N_IAP_AUTH_IMPERSONATE_SERVICE_ACCOUNT="gate-caller@example.iam.gserviceaccount.com"
export N8N_IMPERSONATOR_TOKEN_SOURCE="adc"

Verification

Every check below ran the built CLI against a deployed gateway fronting a real n8n — no curl, no relay process, no hand-minted tokens, and no N8N_API_KEY:

Command	Result
workflow list --limit 3	3 workflows returned
workflow get <id>	returned, fields intact
apply --ids=<id> --dry-run	1 unchanged
workflow create -f <lint-violating>.json --no-lint	refused by the gateway: Workflow violates 2 linter rules and was not forwarded to n8n
workflow create -f <clean>.json	created
workflow update <id> -f <edited>.json	updated; workflow get shows the edit
workflow delete <id> --force	deleted; a 100-row list confirms no residue

Notably the read path succeeded against a gateway whose own build predates the Content-Encoding fix in #50 — the identity request header sidesteps it, so clients are not blocked on the gateway being rebuilt.

Unit tests: tests/api/client-egress.test.ts (chain applied to every call, absent chain leaves requests untouched, a throwing middleware aborts rather than sending unauthenticated, identity encoding requested) and tests/middleware/builtin/iap-auth/adc-impersonate-source.test.ts (grant → mint sequence and payloads, per-audience caching, and the error messages for a key file, an incomplete ADC file, and a denied impersonation).

Suite: 1036 pass, 1 fail — tests/lint/rules/no-plaintext-secrets.test.ts also fails on origin/main at ea0b6d4, confirmed in a clean worktree. Unrelated. tsc --noEmit clean; biome check clean on every touched file.