TW-5785: fix Nylas v3 request shapes + add Scheduler session-token auth

[qasim-nylas]

Summary

Fixes several CLI request shapes that hit the wrong Nylas v3 endpoints or sent invalid payloads, and adds the Scheduler session-token auth flow that booking commands require. Every change was verified against the Nylas v3 spec, and make ci-full (fmt/vet/lint/unit/race/security/vuln/build + the full live-API integration suite) passes.

⚠️ Breaking changes

• scheduler bookings show|confirm|reschedule|cancel now require --configuration-id. These endpoints are authorized by a Scheduler session token, not the application API key; the CLI now mints a session from the configuration and uses it as the bearer. Old invocations error with required flag(s) "configuration-id" not set.
• scheduler bookings confirm: --salt is now required (from the booking reference — organizer link, cancel/reschedule URL, or a Scheduler webhook). --reason is a deprecated no-op.
• admin credentials create: --type no longer accepts oauth/service_account (never valid v3 values) — use connector. --client-id/--client-secret are now required; these are the provider's OAuth app credentials (e.g. your Google Cloud / Azure app), not your Nylas app's — they populate the spec-required credential_data.
• admin credentials list/show/create JSON output no longer includes connector_id/credential_type/credential_data — the v3 CredentialObject returns only id, name, created_at, updated_at.
• admin credentials create: --connector-id is deprecated (use --connector); passing both is now an error.

What changed

Admin / credentials

• Connector credential URL …/credentials → …/creds; credential ops are connector-scoped (auto-detect the sole connector; validate an explicit provider against the v3 allow-list; reject the deprecated inbox provider by name and legacy ID)
• Trimmed ConnectorCredential to the fields the API actually returns
• Offset-paginate credential lists (no more silent truncation at the default 10)
• Connector resolution deduplicated into domain.ResolveConnectorProvider

Scheduler

• Session-token bearer plumbing in the HTTP client; the four booking methods now take a configurationID and mint a session
• Reschedule fixed to bare PATCH /scheduling/bookings/{id}; the booking is read back with the requested times overlaid (the booking model carries no times)
• Confirm requires salt+status and handles the cancelled no-data envelope; cancel sends cancellation_reason in the DELETE body
• Configuration endpoints are grant-scoped; the configuration list is cursor-paginated
• Session TTL tag fixed (ttl → time_to_live)
• Deprecated no-op shims: confirm --reason, reschedule --timezone/--reason

JSON-RPC handlers, mock/demo adapters, unit + integration tests, and command docs updated to match.

Testing

• make ci-full — exit 0 (all quality gates + full live-API integration suite + cleanup)
• New unit tests for connector resolution, provider validation, credential/config pagination (incl. empty-list []-not-null), booking session-token flow, and the deprecated-flag shims

Related docs

CLI command reference:

• scheduler bookings show
• scheduler bookings confirm
• scheduler bookings reschedule
• scheduler bookings cancel
• scheduler configurations list
• admin credentials create
• admin credentials list
• admin connectors list

Nylas v3 API:

• Using multiple provider applications
• Connector credentials API
• Bookings API
• Scheduler API

[AaronDDM]

LGTM 👍