fix(app): five UX papercuts in app list / app view discovery

[ZacxDev]

Why

A blind dogfood of the new App-discovery commands (civitai app list / app view, added in #178) surfaced five UX papercuts. This PR fixes all five, with tests.

The five papercuts & fixes

1. (biggest) Top-level help hid app-browsing. The app group's Short was authoring-only ("Author and ship Civitai Apps"), so a user who wanted to browse the store never learned app list / app view existed from civitai --help.

• Short → Browse, author, and ship Civitai Apps; the group Long now opens with the browse commands.
• Added a "Browse the App store" block to the root Examples (root.go) so civitai --help surfaces civitai app list / civitai app view <slug>.

2. Broken help example. app list's Example used --category productivity — not a valid category, returns HTTP 400.

• Replaced with --category generation (a real category).
• The --category flag help now lists the valid set (generation, games, utility, discovery, moderation, analytics, other), mirroring the backend MARKETPLACE_CATEGORIES enum.

3. app view printed rating: twice. Both the star rating and the content rating were labeled rating: (rating: - (0 review(s)) then rating: content g).

• The content-rating line is now labeled content: → content: g.

4. Enum flags 400'd with an unhelpful generic message. A bad --kind/--sort/--category round-tripped to a bare invalid request parameter (400).

• Server-error surfacing (primary): the store endpoint returns zod's flattened shape {"error":{"formErrors":[...],"fieldErrors":{"<field>":["<msg>"]}}}, which the SDK's badRequestDetail didn't parse. Added flattenedZodDetail so a 400 now surfaces the field-specific message (naming the bad field + constraint) — e.g. invalid request parameter (400): category — Invalid enum value. Expected 'generation' | 'games', received 'productivity'. This stays in sync with the backend enum (no client-side drift). fieldErrors is decoded in document order so the reported field is deterministic.
• Client-side (secondary): the fixed enums --kind (all/onsite/offsite) and --sort (top-rated/popular/newest/name) are validated locally for a fast, offline allowed-values error — no HTTP call. --category is deliberately not hardcoded client-side (its allowlist grows as the backend adds categories); it relies on the improved 400 handling above. --limit's existing local validation is unchanged.

5. Empty list gave a bare header. For a non-mod user (the common case — the catalog is identity/flag-gated) app list printed only the table header, unexplained.

• Now prints a hint matching the --help gating wording: No apps visible for your account — until the store opens publicly you only see apps if your account is a moderator or app-dev-tester, or nothing matches your filters. + a login/relax-filters follow-up.

Tests

• feat(login): OAuth device-flow login + token refresh; submit via token route #4 server-400 surfacing: httptest fake returning the flattened fieldErrors 400 → the command prints the field-specific message (cmd-level), plus an SDK unit test on readError for both fieldErrors and formErrors-only bodies.
• feat(login): OAuth device-flow login + token refresh; submit via token route #4 client-side: a bad --kind/--sort fails locally (asserts no HTTP call) with the allowed-values message.
• CLI DX: page-money template, init --dir/--name, validate warnings, harness next-steps #3 view output contains content: and prints rating: exactly once.
• fix(oauth): form-urlencode the token refresh (was JSON → /token 400s) #5 empty items → the hint line is printed (incl. the mod/tester wording).
• feat: civitai CLI scaffold — App Blocks authoring (Phase 1) #1/Open-source readiness: README, help, CLAUDE.md, release flow, tests, LICENSE #2 regression guards: app/root help advertise browsing; the list help Example does not contain --category productivity and does use a valid category + lists the enum.

Verification

go build ./... && go vet ./... && go test ./... all green (16 packages ok); gofmt -l pkg/civitai internal/cmd clean. Built the binary and eyeballed app --help, app list --help, and app view (shows content: g, not a second rating:).

🤖 Generated with Claude Code