feat(apic): add Azure API Center extract/publish provider

[azaslonov]

Add Azure API Center (apic) extract/publish provider

Summary

This PR adds an additive, self-contained Azure API Center (Microsoft.ApiCenter) provider module to apiops-cli, enabling disaster-recovery style backup and restore of API Center services via two new commands:

# Back up an API Center service to local artifact files
apiops apic extract --resource-group <rg> --service-name <svc> [--workspace <ws>] [--output ./apic-artifacts]

# Restore local artifacts to an API Center service
apiops apic publish --resource-group <rg> --service-name <svc> [--source ./apic-artifacts] [--dry-run]

Both commands honor the existing global options (--subscription-id, --cloud, --format json, --log-level, service-principal auth flags).

Design: zero impact on the APIM path

The existing Azure API Management command path is completely untouched — no shared APIM types, clients, or services were modified, so there is no regression risk. The new module only reuses pure/generic helpers (logger, user-agent, cloud-config auth scope, resource-path template helpers, @azure/identity).

A lightweight provider abstraction (src/models/provider.ts) documents the two providers; the API Center module owns its own metadata model, ARM client, artifact store, and extract/publish services.

What it covers

Walks the Microsoft.ApiCenter/services control-plane tree and round-trips:

• Service scope: metadata schemas, workspaces
• Workspace scope: environments, APIs → versions → definitions → deployments, API sources, analyzer configs, auth configs, resource links, plugins, models, agents → versions, skills → versions, skill/agent evaluation configurations, MCP registries
• API definition specification bodies are exported via exportSpecification and re-imported via importSpecification

Restore applies resources in dependency-tier order so references always exist before dependents are created.

The ARM REST client handles pagination (nextLink), retry/back-off (429/5xx), and long-running operations (Azure-AsyncOperation/Location polling).

Tests

29 new unit tests (all green; full suite 1109 tests pass):

• tests/unit/models/apic-resource-types.test.ts — metadata invariants, root/child resolution, dependency-tier ordering (every child after its parent, full coverage, no duplicates)
• tests/unit/lib/apic-uri.test.ts — ARM URI, collection (list) URI, workspace scoping, labels
• tests/unit/services/apic-artifact-store.test.ts — resource/spec round trip, descriptor reconstruction from the artifact tree, positional-template parsing
• tests/unit/services/apic-extract-publish.test.ts — mocked extract → publish round trip incl. dependency ordering, spec import, and dry-run

New files

src/models/provider.ts
src/models/apic-resource-types.ts
src/models/apic-types.ts
src/lib/apic-uri.ts
src/clients/iapic-client.ts
src/clients/apic-client.ts
src/services/apic-artifact-store.ts
src/services/apic-extract-service.ts
src/services/apic-publish-service.ts
src/cli/apic-command.ts            (registered in src/cli/index.ts)

Deferred to follow-up PRs

Intentionally out of scope for this first PR, to keep it reviewable:

• Blob-backed artifact bodies (agent/skill version content)
• Singletons: portal settings, data-API settings, Event Grid filters
• securityRequirements, extract filters / publish overrides
• init scaffolding and CI pipeline templates for API Center
• Synced-source deduplication, Key Vault secret preflight
• Incremental publish and richer dry-run reporting
• Cross-service ID rewriting for deployment/definition references (currently restored as-is)

Validation

npm run build   # tsc — clean
npm run lint    # eslint — clean
npm test        # vitest — 53 files, 1109 tests passing