bestool's canopy client: the published [bes_canopy_api] wire layer plus bestool's own HTTP transport and registration/backup helpers.

The typed [CanopyClient], the [CanopyTransport] trait, the wire types in [schema], and the error types all come from [bes_canopy_api] and are re-exported here. This crate supplies the parts specific to how bestool reaches canopy:

• [ReqwestTransport], the default [CanopyTransport], which picks canopy's tailscale or mTLS auth path and routes calls accordingly;
• [connect] and [connect_to], which probe for an auth path and build a [CanopyClient] over one;
• [registration], and the backup helpers [TargetOutcome] and [ContainerCreds].

The transport-shaped operations — is_tailscale, refresh, renew — live on [ReqwestTransport]; reach them through CanopyClient::transport.

Wire types

The types in [schema] are generated from canopy's OpenAPI document, which canopy builds and publishes as bes-canopy-api. Timestamp fields are [jiff::Timestamp], credential secrets are wrapped in [Redacted] so they stay out of Debug output, and each generated struct carries a builder and is #[non_exhaustive]. [CanopyClient] has one method per endpoint taking and returning these types; any non-2xx surfaces as [CanopyHttpError].