refactor: rename internal/gateway/client -> internal/cloudclient

The package is the hosted Cloud API side-channel client (websearch/webfetch/
advisor/BYOK over /v1/*), not a gateway runtime. Reserve internal/gateway/
for the real self-hostable gateway. Updates the two importers
(provider/byok.go, provider/wire.go) and the guard-test path assertion; no
behavior change, no new dependencies.

Author: timothyerwin

internal/gateway/client/byok.go internal/cloudclient/byok.gointernal/gateway/client/byok.go renamed to internal/cloudclient/byok.go

@@ -1,4 +1,4 @@
-package client
+package cloudclient
 
 // BYOK key management — the /v1/byok surface. Plain JSON calls (not
 // turn-shaped): list is read-only metadata, put/delete/validate are explicit

internal/gateway/client/client.go internal/cloudclient/client.gointernal/gateway/client/client.go renamed to internal/cloudclient/client.go

@@ -1,10 +1,10 @@
-// Package client is the CLI's HTTP client for the memcode gateway's
+// Package cloudclient is the CLI's HTTP client for the memcode gateway's
 // SIDE-CHANNEL surfaces: /v1/advisor, /v1/websearch, /v1/webfetch, and the
 // /v1/byok key-management routes. The TURN wire lives elsewhere — the shared
 // providers/memcode transport (OpenAI-compat + the memcode extensions). Every
 // call here rides requestWithRetry (Cloud Run cold-start 5xx / 429 / transient
 // net errors), with SetRetryNotify surfacing "⊙ retrying…" in the TUI.
-package client
+package cloudclient
 
 import (
 	"bytes"

internal/gateway/client/retry_test.go internal/cloudclient/retry_test.gointernal/gateway/client/retry_test.go renamed to internal/cloudclient/retry_test.go

@@ -1,4 +1,4 @@
-package client
+package cloudclient
 
 // The side-channel retry contract: every advisor/websearch/byok call rides
 // requestWithRetry — a Cloud Run cold-start 5xx retries (with the notify

internal/gateway/client/web.go internal/cloudclient/web.gointernal/gateway/client/web.go renamed to internal/cloudclient/web.go

@@ -1,4 +1,4 @@
-package client
+package cloudclient
 
 import (
 	"context"

internal/guard/guard_test.go

@@ -67,15 +67,15 @@ func TestCatalogIsStdlibOnly(t *testing.T) {
 // chrome), the transport layer is leaking upward.
 func TestSideChannelClientStaysThin(t *testing.T) {
 	allowed := map[string]bool{
-		modulePrefix + "/internal/gateway/client": true,
-		modulePrefix + "/internal/wire":           true,
-		modulePrefix + "/catalog":                 true,
+		modulePrefix + "/internal/cloudclient": true,
+		modulePrefix + "/internal/wire":        true,
+		modulePrefix + "/catalog":              true,
 	}
-	for _, p := range deps(t, modulePrefix+"/internal/gateway/client") {
+	for _, p := range deps(t, modulePrefix+"/internal/cloudclient") {
 		if isStdlib(p) || allowed[p] {
 			continue
 		}
-		t.Errorf("internal/gateway/client must stay thin (stdlib + wire/catalog), but depends on %q", p)
+		t.Errorf("internal/cloudclient must stay thin (stdlib + wire/catalog), but depends on %q", p)
 	}
 }
 

internal/provider/byok.go

@@ -9,32 +9,32 @@ import (
 	"context"
 	"os"
 
-	"github.com/memcode-ai/memcode/internal/gateway/client"
+	"github.com/memcode-ai/memcode/internal/cloudclient"
 )
 
-func byokClient() (*client.Client, error) {
+func byokClient() (*cloudclient.Client, error) {
 	if os.Getenv(EnvAPIToken) == "" {
 		return nil, ErrNotLoggedIn
 	}
-	return client.New(APIURL(), os.Getenv(EnvAPIToken)), nil
+	return cloudclient.New(APIURL(), os.Getenv(EnvAPIToken)), nil
 }
 
 // ByokList fetches the provider roster + the user's masked key rows.
-func ByokList(ctx context.Context) (client.ByokKeys, error) {
+func ByokList(ctx context.Context) (cloudclient.ByokKeys, error) {
 	c, err := byokClient()
 	if err != nil {
-		return client.ByokKeys{}, err
+		return cloudclient.ByokKeys{}, err
 	}
 	return c.ByokList(ctx)
 }
 
 // ByokPut stores/replaces the user's key for a provider (gateway live-probes
 // it first). The caller is responsible for redacting the key from any UI/log
 // surfaces BEFORE calling.
-func ByokPut(ctx context.Context, providerID, key string) (client.ByokPutResult, error) {
+func ByokPut(ctx context.Context, providerID, key string) (cloudclient.ByokPutResult, error) {
 	c, err := byokClient()
 	if err != nil {
-		return client.ByokPutResult{}, err
+		return cloudclient.ByokPutResult{}, err
 	}
 	return c.ByokPut(ctx, providerID, key)
 }

internal/provider/wire.go

@@ -15,8 +15,8 @@ import (
 	"fmt"
 	"time"
 
+	"github.com/memcode-ai/memcode/internal/cloudclient"
 	"github.com/memcode-ai/memcode/internal/doctrine"
-	"github.com/memcode-ai/memcode/internal/gateway/client"
 	compat "github.com/memcode-ai/memcode/internal/providers/compat"
 	memcodeprov "github.com/memcode-ai/memcode/internal/providers/memcode"
 	"github.com/memcode-ai/memcode/internal/wire"
@@ -49,7 +49,7 @@ type turnTransport interface {
 // already degrade on error).
 type conn struct {
 	turn turnTransport
-	side *client.Client
+	side *cloudclient.Client
 	ep   *Endpoint // non-nil = arbitrary-endpoint mode (no memcode backend)
 }
 
@@ -63,7 +63,7 @@ func dial(url, token string) *conn {
 			Token:   token,
 			Compose: composeDoctrine,
 		}),
-		side: client.New(url, token),
+		side: cloudclient.New(url, token),
 	}
 }