Implement Nebius provider boilerplate

[devin-ai-integration]

Implement Nebius provider boilerplate

Summary

This PR implements the foundational boilerplate for the Nebius cloud provider in the Brev Cloud SDK, following the established Lambda Labs pattern. The implementation adds complete stub implementations for all CloudClient interface methods, proper credential handling, and updated documentation.

Key Changes:

• Added github.com/nebius/gosdk dependency
• Created complete Nebius provider structure in internal/nebius/v1/
• Implemented NebiusCredential and NebiusClient structs with all required interface methods
• All methods return ErrNotImplemented as stubs, ready for actual API implementation
• Updated security and contribution documentation with Nebius-specific setup instructions

Capabilities Declared:

• Instance lifecycle management (Create, Get, List, Terminate, Stop, Start, Reboot)
• Advanced features (Firewall, Images, Volume resizing, Tags, User data)
• Quota and location management

Review & Testing Checklist for Human

• CRITICAL: Verify Nebius Go SDK API usage - Check that gosdk.New() and gosdk.IAMToken() are the correct way to initialize the SDK with service account credentials. The API may have changed since research.
• Test compilation in clean environment - Run make lint and make test to ensure no dependency or build issues (linting failed in dev environment due to testify package issues)
• Verify CloudClient interface compliance - Cross-reference with pkg/v1/client.go to ensure all required interface methods are implemented
• Review authentication documentation accuracy - Check that JWT-based service account flow described in SECURITY.md matches actual Nebius SDK patterns
• Test basic client instantiation - Verify NewNebiusClient() can be called without errors (even with dummy credentials)

Recommended Test Plan:

1. Clean build: go build ./internal/nebius/v1/...
2. Import check: Try importing and instantiating NebiusCredential in a test file
3. Interface verification: Use Go's type checking to verify NebiusClient satisfies CloudClient

---

Diagram

%%{ init : { "theme" : "default" }}%%
graph TB
    subgraph "Core SDK"
        client["pkg/v1/client.go<br/>CloudClient interface"]:::context
        instance["pkg/v1/instance.go<br/>Instance types"]:::context
        capabilities["pkg/v1/capabilities.go<br/>Capability definitions"]:::context
    end
    
    subgraph "Nebius Provider (NEW)"
        nclient["internal/nebius/v1/client.go<br/>NebiusClient + NebiusCredential"]:::major-edit
        ninst["internal/nebius/v1/instance.go<br/>Instance management stubs"]:::major-edit
        ncap["internal/nebius/v1/capabilities.go<br/>Nebius capabilities"]:::major-edit
        nnet["internal/nebius/v1/networking.go<br/>Firewall stubs"]:::major-edit
        nimg["internal/nebius/v1/image.go<br/>Image management stubs"]:::major-edit
        nstor["internal/nebius/v1/storage.go<br/>Volume management stubs"]:::major-edit
    end
    
    subgraph "Documentation"
        security["internal/nebius/SECURITY.md<br/>Auth implementation details"]:::minor-edit
        contrib["internal/nebius/CONTRIBUTE.md<br/>Setup instructions"]:::minor-edit
    end
    
    subgraph "Dependencies"
        gomod["go.mod<br/>Added nebius/gosdk"]:::minor-edit
        gosdk["github.com/nebius/gosdk<br/>External dependency"]:::context
    end
    
    client --> nclient
    instance --> ninst
    capabilities --> ncap
    nclient --> gosdk
    gomod --> gosdk
    
    subgraph Legend
        L1["Major Edit"]:::major-edit
        L2["Minor Edit"]:::minor-edit  
        L3["Context/No Edit"]:::context
    end
    
    classDef major-edit fill:#90EE90
    classDef minor-edit fill:#87CEEB
    classDef context fill:#FFFFFF

Loading

Notes

• Link to Devin run: https://app.devin.ai/sessions/7e400ee399d34292a0dc47a816954734
• Requested by: @theFong (Alec Fong)
• Implementation approach: Follows exact same pattern as Lambda Labs provider with NotImplCloudClient embedding for graceful handling of unsupported features
• Authentication: Uses JWT-based service account authentication (needs verification)
• API Type: Configured as APITypeLocational based on Nebius architecture research
• Ready for: Actual API implementation to replace stub methods returning ErrNotImplemented

This is foundational work that establishes the complete provider structure. All interface methods are implemented as stubs, making it safe to integrate while actual Nebius API calls are developed incrementally.

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring

[theFong]

can you fix the and rebase/remake the go.mod/sum

[theFong]

what do you update the instance for? Changing name/metadata? how does this fit into the v1/interface

[theFong]

can you verify this?

[devin-ai-integration]

@theFong I've verified this by examining the Nebius API documentation:

✅ Change Instance Type IS supported:

• Nebius InstanceService.Update can modify InstanceSpec
• ResourcesSpec.preset field (the instance type) has NO IMMUTABLE annotation
• ResourcesSpec.platform is marked as IMMUTABLE but preset is not
• This maps to CloudClient's ChangeInstanceType(instanceID, instanceType string) method

Evidence: https://github.com/nebius/api/blob/main/nebius/compute/v1/instance.proto

• Line ~86: ResourcesSpec.preset has no IMMUTABLE annotation
• Line ~82: ResourcesSpec.platform is marked [(field_behavior) = IMMUTABLE] but preset is not

I've updated the README to correctly show this as supported and removed the contradictory entry from unsupported features. The latest commit (b98cf90) reflects these corrections.