fix(cli): home-screen heartbeat times out — fetch single client via GET /edge-device/{id}/, not ListClients

[saadqbal]

Symptom

Bare tracebloc/tb home screen shows a false-negative:

⚠ Secure environment "…" · running — couldn't confirm it's connected to tracebloc — run tb doctor

…while tb doctor is fully green (Backend auth ✔, egress ✔, active client resolved). So the backend IS reachable; the home probe just can't confirm it in time.

Root cause

realHeartbeat (internal/cli/home.go) → lookupClientStatus → api.Client.ListClients, which does GET /edge-device/ and paginates through every client in the account (up to maxListPages=100), then filters client-side for the active ID — all under homeProbeTimeout=1200ms / homeDetectBudget=1500ms. On accounts with enough clients to need multiple pages (or with slow prod round-trips), the list can't finish in 1.2s → context deadline → err → beatUnknown → "couldn't confirm". tb doctor is green because its Backend-auth check is a single GET /userinfo/ with no tight timeout.

Fix

Add api.Client.GetClient(ctx, id) → GET /edge-device/{id}/ (single O(1) call; the detail route already exists — PatchClientClusterID uses it) and switch lookupClientStatus to it instead of ListClients+client-side find. Remove the now-dead findClientByID (blocking deadcode gate). One fast round-trip fits comfortably in the budget → honest Online/not-online instead of spurious "couldn't confirm".

Found while diagnosing a live prod home screen (account client id 1070).