feat(push): cf push --https for direct-to-S3 upload (2.5.0) (#18)

* feat(push): cf push --https for direct-to-S3 upload (2.5.0)

Adds a third push option alongside SFTP and `cf push --remote`. Use when
both port 22 and GitHub are blocked by a corporate firewall but outbound
HTTPS to AWS S3 is allowed.

- New _push_https flow: picks wrapper GDS (+ user_defines.v when non-openframe),
  SHA-256s each file locally, asks the platform for pre-signed PUT URLs,
  PUTs each file directly to S3, then asks the platform to commit them.
- Mutually exclusive with --remote.
- No Git involvement — the platform synthesizes .cf/project.json server-side
  and the Lambda re-verifies sha256 byte-for-byte before staging on EFS.
- README + portal docs updated to describe all three push modes.

Made-with: Cursor

* fix(api): surface backend error detail instead of bare HTTP status

_api_get/_api_post/_api_put were printing the raw
`Client error '409 Conflict' for url ...` message from httpx when the
backend returned a 4xx/5xx. That dropped the useful bit — FastAPI's
`{"detail": "..."}` payload — so users saw no actionable reason.

Now extracts `detail` (string or validation-list form) and prints
`HTTP 409: <detail>`. Applies to every CLI command that goes through
the shared _api_* helpers (push --remote, push --https, link, etc.).

Made-with: Cursor

* chore: re-level to 2.4.3 for the --https push feature

cf push --https is a transport variant of the existing push command,
not a standalone new capability — same manifest/sync flow as --remote,
which also shipped as a patch under 2.3.x. Rolling back the earlier
jump to 2.5.0 so the --https work ships as 2.4.3 alongside the
error-surfacing fix on the same feature branch.

Made-with: Cursor

* feat(push): progress bar for cf push --https uploads (2.4.4)

Matches the rich progress UX of the SFTP push path (utils.upload_with_progress):
percent, bytes, transfer speed and elapsed time per file. We stream the
body with a generator so httpx can drive bar updates on every chunk,
and set Content-Length explicitly so S3 doesn't fall back to chunked
encoding (pre-signed PUTs don't allow it).

Made-with: Cursor

---------

Co-authored-by: jdicorpo <jdicorpo@gmail.com>

Author: jeffdi

README.md

@@ -577,6 +577,7 @@ cf push [OPTIONS]
 - `--sftp-username`: Override configured username (SFTP mode only)
 - `--sftp-key`: Override configured key path (SFTP mode only)
 - `--remote`: HTTPS-only upload via the ChipFoundry GitHub App (no SFTP). Use this when port 22 is blocked by your corporate firewall.
+- `--https`: HTTPS-only direct upload to AWS S3 (no SFTP, no GitHub). Use this when both SFTP and GitHub are blocked by your corporate firewall.
 
 **SFTP mode (default):**
 1. Verifies the project is linked to the platform and you are logged in
@@ -610,6 +611,34 @@ What happens:
 > network, run `cf push --remote` instead. No VPN required — just outbound
 > HTTPS and a GitHub repo linked to the project.
 
+**HTTPS direct mode — `cf push --https`:**
+
+Firewall-friendliest fallback: no SFTP, no GitHub, no Git at all. The CLI
+uploads your push-critical files directly to an AWS S3 staging bucket over
+HTTPS using short-lived pre-signed PUT URLs, then the platform stages the
+objects onto your SFTP landing zone. Use this when your network blocks
+both port 22 and GitHub.
+
+Preconditions:
+- Project is linked to the platform (`cf init` or `cf link`) and you are logged in.
+- Wrapper GDS exists locally under `gds/` (one of `user_project_wrapper.gds[.gz]`,
+  `user_analog_project_wrapper.gds[.gz]`, `openframe_project_wrapper.gds[.gz]`).
+- For non-openframe projects, `verilog/rtl/user_defines.v` is also uploaded when present.
+- Outbound HTTPS to `*.s3.us-east-2.amazonaws.com` is allowed.
+
+What happens:
+1. `cf push --https` picks the wrapper GDS (and `user_defines.v` if applicable) and hashes each file with SHA-256 locally.
+2. Platform returns one pre-signed PUT URL per file; the CLI PUTs each file directly to S3 over HTTPS.
+3. Platform stages the objects onto your SFTP landing zone, re-verifying SHA-256 byte-for-byte and synthesizing `.cf/project.json` from the authoritative platform data.
+4. Staged S3 objects are deleted on success; any leftovers are expired by the bucket lifecycle after 7 days.
+5. `--submit` submits for review on success.
+
+> [!TIP]
+> Try modes in this order: `cf push` → `cf push --remote` → `cf push --https`.
+> The SFTP mode is fastest when unrestricted, `--remote` is the best HTTPS
+> option when you already keep the project on GitHub, and `--https` is the
+> "direct upload" escape hatch that works even with no Git.
+
 **GDS File Handling:**
 - **Both compressed (`.gz`) and uncompressed (`.gds`) files are supported**
 - **No automatic compression** - files are uploaded as-is