Atlas: automate cluster ops with the Atlas CLI

# Atlas CLI automation

## Setup

`atlas auth login` once per machine (or use API keys via environment variables in CI). Select the default org and project, or pass `--orgId` / `--projectId` per command.

## Useful commands

```bash
# clusters
atlas clusters list
atlas clusters create myCluster --tier M10 --provider AWS --region US_EAST_1

# database users
atlas dbusers create --username app-svc --password [generated] --role readWrite@mydb

# network access
atlas accessLists create --ip [egress-ip] --comment "ci runner"

# backups
atlas backups snapshots list myCluster
atlas backups restores start --clusterName myCluster --snapshotId [id] --targetClusterName restored

# pause / resume dev clusters
atlas clusters pause myDevCluster
atlas clusters start myDevCluster
```

## Rules

- Never put passwords on the command line in shared environments; prefer generated passwords stored straight into the secret manager.
- Pin the CLI version in CI; command flags drift between releases.
- Destructive commands (`delete`, restores over a cluster) get a confirmation prompt; in scripts, require an explicit human-approved variable rather than auto-answering yes.

## Verify

After scripting, run the read-only commands (`list`, `describe`) in CI to prove auth works, and do one full create-then-delete cycle of a scratch cluster to prove the write path.