feat: add internal cluster admin endpoints

backend/internal/cluster/repository_test.go

@@ -83,6 +83,37 @@ func TestRepositoryReturnsErrorWhenStoredTokenUsesWrongKey(t *testing.T) {
 	}
 }
 
+func TestRepositorySetsClusterStatusWithoutDecryptingToken(t *testing.T) {
+	storage := newMemoryStorage()
+	repository := NewRepositoryWithStorage(storage, testCipher(t, 1))
+
+	_, err := repository.UpsertCluster(context.Background(), Cluster{
+		ID:             "cluster-1",
+		Name:           "Lab",
+		APIEndpoint:    "https://pve.example.test:8006",
+		TLSFingerprint: "AA:BB",
+		TokenID:        "root@pam!proxui",
+		TokenSecret:    "secret-token",
+	})
+	if err != nil {
+		t.Fatalf("UpsertCluster() error = %v", err)
+	}
+
+	updated, found, err := repository.SetClusterStatus(context.Background(), "cluster-1", "disabled")
+	if err != nil {
+		t.Fatalf("SetClusterStatus() error = %v", err)
+	}
+	if !found {
+		t.Fatal("SetClusterStatus() found = false, want true")
+	}
+	if updated.Status != "disabled" {
+		t.Fatalf("Status = %q, want disabled", updated.Status)
+	}
+	if updated.TokenSecret != "" {
+		t.Fatal("SetClusterStatus() returned token secret")
+	}
+}
+
 func testCipher(t *testing.T, value byte) encryption.Cipher {
 	t.Helper()
 
@@ -124,3 +155,13 @@ func (s *memoryStorage) Upsert(_ context.Context, cluster StoredCluster) (Stored
 	s.records[cluster.ID] = cluster
 	return cluster, nil
 }
+
+func (s *memoryStorage) SetStatus(_ context.Context, id string, status string) (StoredCluster, bool, error) {
+	cluster, ok := s.records[id]
+	if !ok {
+		return StoredCluster{}, false, nil
+	}
+	cluster.Status = status
+	s.records[id] = cluster
+	return cluster, true, nil
+}