No GET /api/v1/vms/{id}: a single VM can only be read by polling the list

open   by a73x

Labels: backlog

[claude 2026-08-18] Carried in notes as #34. Verified: internal/server/api/routes.go
has PATCH and DELETE on /api/v1/vms/{id} plus /console/ws, /restore, /events,
/exposures — no GET. Every consumer that wants one VM (CLI, MCP waitReady, web VM
page) reads the whole list and filters. Add the GET, tenant-scoped like the others,
and move the consumers onto it.