refactor(maestro): dedup CLI JWT percent-encoder onto urlencoding crate (NAP-273 part A)

`maestro-cli` carried a hand-rolled `urlencoding()` for the attach-token query
param while `maestro-daemon` already used the `urlencoding` crate for the same
wire field. Two encoders for one field is exactly the drift that only surfaces
in production — collapse to the crate (`urlencoding = "2"`), deleting the local
copy. The unreserved set is identical, so the encoded output is unchanged
(existing `attach_url` tests pass).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

crates/maestro-cli/Cargo.toml

@@ -28,6 +28,7 @@ tokio-tungstenite = { workspace = true, features = ["rustls-tls-webpki-roots"] }
 toml.workspace = true
 tracing.workspace = true
 tracing-subscriber.workspace = true
+urlencoding = "2"
 uuid.workspace = true
 
 [dev-dependencies]

crates/maestro-cli/src/attach.rs

@@ -75,7 +75,7 @@ pub fn attach_url(info: &ConnectInfo, session_id: Uuid) -> Result<String, Attach
     }
     Ok(format!(
         "{base}/sessions/{session_id}/stream?token={token}",
-        token = urlencoding(&info.jwt)
+        token = urlencoding::encode(&info.jwt)
     ))
 }
 
@@ -106,24 +106,6 @@ pub fn broker_attach_url(
     Ok(format!("{ws_base}/api/attach/{session_id}"))
 }
 
-/// Minimal percent-encoder for the token in a query string. JWTs only contain
-/// `A-Z a-z 0-9 - _ .` (URL-safe base64 + dots) so this is paranoia, not need.
-fn urlencoding(s: &str) -> String {
-    let mut out = String::with_capacity(s.len());
-    for b in s.bytes() {
-        match b {
-            b'A'..=b'Z' | b'a'..=b'z' | b'0'..=b'9' | b'-' | b'_' | b'.' | b'~' => {
-                out.push(b as char);
-            }
-            _ => {
-                out.push('%');
-                out.push_str(&format!("{b:02X}"));
-            }
-        }
-    }
-    out
-}
-
 /// RAII guard that puts the terminal into raw mode and restores on drop.
 #[derive(Debug)]
 struct RawTty {