fix: resync client COMMANDS with live API to unblock CI

[statico-alt]

src/api-sync.test.ts checks client.ts COMMANDS against the live OpenAPI spec, so it goes red on every open PR as soon as the server API drifts. It is currently failing on main and is blocking #26 and #27, neither of which touches COMMANDS.

Changes

Removed 2 dead commands. salvage_wreck and sell_ship no longer exist server-side — no handler, protocol MsgType, or help entry remains in the gameserver, and the release notes record salvage_wreck as removed. The client was advertising both to players. Replacements already shipped in the client: loot_wreck / tow_wreck → sell_wreck / scrap_wreck, and list_ship_for_sale / sell_ship_to_order / scrap_ship.

Added the 19 shipped endpoints missing from COMMANDS — ship buy orders, battle log/summary, hunt, inspect, shipping, observation + notification mute, the login_link device flow, and outpost/espionage/garages. Args are taken from the spec's request schemas.

Test fix: only POST spec paths are commands. GET /api/catalog.json is a bulk download and was being demanded as a COMMANDS entry.

Note for the dev team

Two things about this check worth a look, not addressed here:

1. It is a live-network drift detector wired as a required PR check, so any gameserver release breaks every open client PR regardless of content.
2. It silently passes on HTTP 429 (the spec endpoint is capped at 1 fetch/min/IP), so the check is nondeterministic — it green-lights on rate-limit and hard-fails otherwise.

A nightly job, or failing closed on 429, would make this deterministic.

Verification

Lint, version.test.ts (71 pass), and api-sync.test.ts all pass locally. The api-sync run was confirmed to be a real fetch (3 expect() calls), not the 429 skip path.

🤖 Generated with Claude Code