feat(cli): cover every OpenAPI endpoint and request-body param

[nicoloboschi]

Summary

• Wires the Rust CLI up to every endpoint in the Hindsight OpenAPI spec (46/62 → 62/62) and adds new webhook, audit, and bank-template subcommands plus memory history / per-memory clear-observations, document update, operation retry, bank set-disposition / consolidation-recover.
• Fixes previously-hardcoded request-body fields so the user can actually set them: directive --priority; mental-model --tags / --max-tokens / --trigger-refresh-after-consolidation; recall --query-timestamp; reflect --fact-types / --exclude-mental-models / --exclude-mental-model-ids; retain --document-tags.
• Adds cli-coverage-check in hindsight-dev + a new CI job that fails any PR where a new OpenAPI endpoint or request-body field isn't wired into the CLI (or explicitly skipped in hindsight-cli/.openapi-coverage.toml with a reason). Current state: 62 operations + 89 request params covered, with 38 fields explicitly skipped for documented reasons (flattened into several flags, nested structs, or surfaced via a different subcommand).

Why

The CLI had silently fallen behind the API — 16 endpoints had no command at all (entire webhook + audit subsystems, bank templates, memory history, document update, operation retry, consolidation recovery, update_bank_disposition) and several commands hardcoded request-body fields that the API accepts. There was no automated check to catch the drift, so new endpoints kept slipping through.

How the CI check works

• uv run cli-coverage-check (in hindsight-dev) parses hindsight-docs/static/openapi.json and cross-checks:
  1. Every operationId is called somewhere in hindsight-cli/src/**/*.rs. The progenitor-generated client methods are named identically to the OpenAPI operationId, so .<op_id>( is a strong signal.
  2. Every request-body property is present in hindsight-cli/src/main.rs as a clap command variant field or long = "..." attribute.
• Anything that legitimately isn't exposed lives in hindsight-cli/.openapi-coverage.toml under [skip] (operation-level) or [fields.<op_id>] (field-level) — each entry must carry a reason string.
• Stale skip entries (operation or field no longer in the spec) also fail the check.

Test plan

• ./scripts/hooks/lint.sh passes
• cargo build + cargo test pass (76 tests)
• uv run cli-coverage-check reports OK: all 62 operations and 89 request params covered
• hindsight --help shows new webhook, audit subcommands; hindsight bank --help shows new template/recover/set-disposition; hindsight memory --help shows history and clear-observations
• CI check-cli-coverage job runs green
• Smoke test (HINDSIGHT_CLI=... ./hindsight-cli/smoke-test.sh) exercises the new webhook / audit / bank-template / memory-history / operation-retry commands against a live API