`apply`: Add `--selector` flag for declarative resource management (including deletions)

[jsbroks]

Summary

Add a --selector flag to ctrlc apply that defines a management scope using metadata key-value pairs. Resources matching the selector but not present in the applied configuration files will be deleted automatically.

Background

Currently, ctrlc apply only creates or updates resources. Removing resources requires manually running ctrlc delete or using the UI. In GitOps workflows, users expect a declarative model where configuration files represent the desired state—resources not present should be automatically removed.

Since there's no server-side tracking of which resources were previously applied, a selector is required to define the "management boundary" for deletions.

Proposed Behavior

Command	Behavior
ctrlc apply -f config/	Create/update only (current behavior)
ctrlc apply -f config/ --selector key=value	Create/update from files AND delete resources matching selector that aren't in files

Logic

Resources matching selector AND in files    → upserted
Resources matching selector NOT in files    → deleted
Resources NOT matching selector             → untouched

Example Usage

# Declaratively manage all resources for "platform" team
ctrlc apply -f config/ --selector team=platform

# Multiple selectors (AND logic)
ctrlc apply -f config/ --selector team=platform --selector env=staging

# Preview changes first
ctrlc apply -f config/ --selector env=staging --dry-run

Example Output

$ ctrlc apply -f config/ --selector team=platform

✓ Deployment/api-server upserted (id: abc123)
✓ Deployment/worker upserted (id: def456)
✓ Environment/staging upserted (id: ghi789)
✗ Deployment/old-service deleted (id: xyz999)
✗ Deployment/deprecated-job deleted (id: uvw888)

Applied 5 resources: 3 upserted, 2 deleted, 0 failed

Acceptance Criteria

• --selector flag added to ctrlc apply (format: key=value, can be specified multiple times)
• Multiple selectors use AND logic (all must match)
• When --selector is provided, query resources matching the metadata
• Resources matching selector but not in config files are deleted
• Without --selector, behavior is unchanged (create/update only)
• --dry-run flag shows what would happen without making changes
• Clear output distinguishing upserted vs deleted resources

Related Files

• cmd/ctrlc/root/apply/cmd.go - Main apply command logic
• cmd/ctrlc/root/apply/types.go - Result types
• cmd/ctrlc/root/apply/delete.go - Existing delete logic (can reuse)