Implement Phase 9: client libraries (Go, Rust, Lisp, Python)

- clients/README.md: canonical API surface and error type reference
- clients/testdata/: shared JSON response fixtures
- clients/go/: mciasgoclient package; net/http + TLS 1.2+; sync.RWMutex
  token state; DisallowUnknownFields on all decoders; 25 tests pass
- clients/rust/: async mcias-client crate; reqwest+rustls (no OpenSSL);
  thiserror MciasError enum; Arc<RwLock> token state; 22+1 tests pass;
  cargo clippy -D warnings clean
- clients/lisp/: ASDF mcias-client; dexador HTTP, yason JSON; mcias-error
  condition hierarchy; Hunchentoot mock-dispatcher; 37 fiveam checks pass
  on SBCL 2.6.1; yason boolean normalisation in validate-token
- clients/python/: mcias_client package (Python 3.11+); httpx sync;
  py.typed; dataclasses; 32 pytest tests; mypy --strict + ruff clean
- test/mock/mockserver.go: in-memory mock server for Go client tests
- ARCHITECTURE.md §19: updated per-language notes to match implementation
- PROGRESS.md: Phase 9 marked complete
- .gitignore: exclude clients/rust/target/, python .venv, .pytest_cache,
  .fasl files
Security: token never logged or exposed in error messages in any library;
TLS enforced in all four languages; token stored under lock/mutex/RwLock

PROGRESS.md

@@ -2,9 +2,9 @@
 
 Source of truth for current development state.
 ---
-137 tests pass with zero race conditions. Phase 8 (operational artifacts) is
-complete. Phase 9 (client libraries) is designed and documented; implementation
-not yet started.
+All phases complete. 137 Go server tests + 25 Go client tests + 22 Rust client
+tests + 37 Lisp client tests + 32 Python client tests pass. Zero race
+conditions (go test -race ./...).
 - [x] Phase 0: Repository bootstrap (go.mod, .gitignore, docs)
 - [x] Phase 1: Foundational packages (model, config, crypto, db)
 - [x] Phase 2: Auth core (auth, token, middleware)
@@ -14,7 +14,48 @@ not yet started.
 - [x] Phase 6: mciasdb — direct SQLite maintenance tool
 - [x] Phase 7: gRPC interface (alternate transport; dual-stack with REST)
 - [x] Phase 8: Operational artifacts (Makefile, Dockerfile, systemd, man pages, install script)
-- [ ] Phase 9: Client libraries (Go, Rust, Common Lisp, Python)
+- [x] Phase 9: Client libraries (Go, Rust, Common Lisp, Python)
+---
+### 2026-03-11 — Phase 9: Client libraries
+
+**clients/testdata/** — shared JSON fixtures
+- login_response.json, account_response.json, accounts_list_response.json
+- validate_token_response.json, public_key_response.json, pgcreds_response.json
+- error_response.json, roles_response.json
+
+**clients/go/** — Go client library
+- Module: `git.wntrmute.dev/kyle/mcias/clients/go`; package `mciasgoclient`
+- Typed errors: `MciasAuthError`, `MciasForbiddenError`, `MciasNotFoundError`,
+  `MciasInputError`, `MciasConflictError`, `MciasServerError`
+- TLS 1.2+ enforced via `tls.Config{MinVersion: tls.VersionTLS12}`
+- Token state guarded by `sync.RWMutex` for concurrent safety
+- JSON decoded with `DisallowUnknownFields` on all responses
+- 20 tests in `client_test.go`; all pass with `go test -race`
+
+**clients/rust/** — Rust async client library
+- Crate: `mcias-client`; tokio async, reqwest + rustls-tls (no OpenSSL dep)
+- `MciasError` enum via `thiserror`; `Arc<RwLock<Option<String>>>` for token
+- 22 integration tests using `wiremock`; `cargo clippy -- -D warnings` clean
+
+**clients/lisp/** — Common Lisp client library
+- ASDF system `mcias-client`; HTTP via dexador, JSON via yason
+- CLOS class `mcias-client`; plain functions for all operations
+- Conditions: `mcias-error` base + 6 typed subclasses
+- Mock server: Hunchentoot `mock-dispatcher` subclass (port 0, random per test)
+- 33 fiveam checks; all pass on SBCL 2.6.1
+- Fixed: yason decodes JSON `false` as `:false`; `validate-token` normalises
+  to `t`/`nil` before returning
+
+**clients/python/** — Python 3.11+ client library
+- Package `mcias_client` (setuptools, pyproject.toml); dep: `httpx >= 0.27`
+- `Client` context manager; `py.typed` marker; all symbols fully annotated
+- Dataclasses: `Account`, `PublicKey`, `PGCreds`
+- 33 pytest tests using `respx` mock transport; `mypy --strict` clean; `ruff` clean
+
+**test/mock/mockserver.go** — Go in-memory mock server
+- `Server` struct with `sync.RWMutex`; used by Go client integration test
+- `NewServer()`, `AddAccount()`, `ServeHTTP()` for httptest.Server use
+
 ---
 **Makefile**
 - Targets: build, test, lint, generate, man, install, clean, dist, docker