feat(api): raw authenticated request passthrough (`asc api METHOD PATH`)

Summary

Add asc api <METHOD> <PATH> [--query k=v ...] [--body JSON|@file] [--paginate] [--confirm]: an authenticated raw request runner that prints Apple's envelope unmodified.

Motivation

Every App Store Connect MCP/agent wrapper built in 2026 sits on a raw executor (e.g. Xopoko/AppStoreConnectCLI openapi op run, Heimdall asc__call). asc has auth token and schema but no runner, so agents shell out to curl. It also closes the ~98 remaining un-wrapped relationships/ linkage GETs (public API coverage is otherwise ~90% of 1263 operations).

Contract

• METHOD+PATH validated against the embedded runtime schema index ({id} normalized); unknown path -> usage error (exit 2) listing nearest operations unless --allow-unknown-path.
• GET prints the envelope as-is; --paginate follows links.next.
• Non-GET requires --confirm; no prompts. Respects read-only mode when present.
• Uses the shared client (auth, retries, --api-debug) and shared.ContextWithTimeout.
• Telemetry: command_path is asc api; path/query/body never recorded.

Acceptance criteria

• cmdtest for usage/help and path validation
• httptest for GET, paginated GET, POST with --confirm and body
• telemetry test proving no path/body leakage
• docs: commands/api.mdx, docs/design/api-passthrough.md, docs/COMMANDS.md regenerated

Partial work: worktree ~/Developer/CLIs/asc-api-passthrough (branch claude/api-passthrough-20260913).