feat: implement apiops compare command

[EMaher]

Adds apiops compare — a new subcommand that compares two APIM instances via the ARM REST API and reports resource-level differences. Designed for deployment verification and environment drift investigation.

Normalization logic is ported from tests/integration/all-resource-types/Compare-ApimInstance.ps1.

New modules

• src/lib/compare-normalizer.ts — Strips ARM envelope fields, read-only/timestamp properties, and replaces instance-specific values with stable placeholders before comparison:

  • Subscription IDs, resource groups, service names → {{sub}}, {{rg}}, {{apim-name}}
  • Key Vault URIs, App Insights/Event Hub resource names → placeholders
  • 24-char hex auto-generated IDs and GUIDs → {{auto-id}} / {{guid}}
  • Resources with auto-generated names keyed by sorted normalized content as {{auto-id-0}}, {{auto-id-1}}, … for stable cross-instance matching
  • APIM ARM paths derived from context.baseUrl (via getArmPathFromBaseUrl / splitAtProviders) — no hardcoded provider type strings

• src/lib/compare-differ.ts — Deep recursive JSON diff with dot-notation paths; skips .properties.value on secret named values and .properties.credentials on EventHub/AppInsights loggers. Each ResourceDiff carries an explicit status field (missing | extra | different) for structured output.

• src/services/compare-service.ts — Hierarchical orchestrator using the same dependency graph and resource-path libraries as extract and publish:

  • Top-level types derived from TIER_1_RESOURCES, TIER_2_RESOURCES, and non-child TIER_3_RESOURCES (via isChildType()) — same pattern as extract-service.ts
  • Child types per parent (API, Product, Gateway) derived from getDependencies() via getChildTypesOf() — new resource types added to the dependency graph are automatically included
  • Per-type options (exclusion lists, secret/credential skip flags) centralized in a TYPE_OPTIONS map
  • Built-in exclusions: echo-api, administrators/developers/guests, starter/unlimited, master

• src/cli/compare-command.ts — Commander subcommand with --format text|table|json output modes and plain-text (emoji-free) console output:

  • text (default): per-type summary with field-level diff details
  • table: ASCII table with Resource (by resource ID), Status (missing, extra, different, skipped), and Notes columns
  • json: same row structure as table, machine-readable

CLI interface

apiops compare \
  --source-subscription-id <id> \
  --source-resource-group <rg> --source-service-name <name> \
  --target-subscription-id <id> \
  --target-resource-group <rg> --target-service-name <name> \
  [--format text|table|json]

All six resource-identity flags are required. --source-subscription-id and --target-subscription-id are independent — use them when the instances are in different subscriptions or the same one.

Exit codes: 0 = identical, 1 = differences found, 2 = fatal error

Supporting changes

• src/cli/index.ts — --subscription-id removed from global options; it is now a per-command required option on extract and publish (with AZURE_SUBSCRIPTION_ID env var fallback)
• src/cli/extract-command.ts / src/cli/publish-command.ts — --subscription-id added as a mandatory per-command option
• src/models/config.ts — adds CompareConfig
• specs/contracts/cli-commands.md — updated global options table, extract/publish option tables, and compare command documentation
• specs/tasks.md — Phase 9 added with all compare tasks