ClickStack: expose dashboard CRUD and validation with full configuration support

[sdairs]

Relationship to #118

Dashboard slice of umbrella #118: six existing API operations have no CLI commands. Earlier drift fixes added containers/on-click/heatmaps (#203/#205), richer chart models (#308/#311), and #522 adds formulas, filter variables and saved filter unions. These must be covered by the initial CLI implementation instead of becoming another follow-up gap.

Scope and command design

cloud clickstack dashboard list|get|create|update|delete|validate <SERVICE_ID> .... Create/update/validate accept --config-file <PATH|->; get/update/delete take a dashboard ID. Use the shared ClickStack typed input/output infrastructure from the source/role slice.

Methods: click_stack_list_dashboards, click_stack_get_dashboard, click_stack_create_dashboard, click_stack_update_dashboard, click_stack_delete_dashboard, click_stack_validate_dashboard. Create and validate use ClickStackCreateDashboardRequest; update uses ClickStackUpdateDashboardRequest and PUT.

Configuration must carry name, tiles, tags, filters, savedQuery, savedQueryLanguage, savedFilterValues and containers; complete tile layout/series/config and all supported chart families (line/bar/table/number/pie/categorical-bar/heatmap/search/event-patterns/markdown), chart unions, on-click targets and containers/tabs. Include the #522 fields: formulas (expression, alias, numberFormat), showOperandSeries, seriesLimit where present; filters isBroadcastEnabled/isVariableEnabled/variableName; both SQL and variable saved-filter values.

Dependencies and implementation

1. Merge OpenAPI drift: 108 gaps between live spec and library #522 and land the source/role shared CLI skeleton. No need to wait for saved-search or alert command implementation.
2. Parse typed configuration preserving every writable nested field. Make PUT replacement explicit and avoid silently defaulting absent fields from a GET response.
3. Surface validation output via ClickStackValidateDashboardResponse, including valid=false/errors. Validate is side-effect-free but uses POST: verify API-key/OAuth support and classify consistently with the gateway rather than assuming every read operation accepts OAuth.
4. Preserve structured API errors using existing CloudClient conversion; OpenAPI drift: 108 gaps between live spec and library #522 validation-error response models are not new endpoints.

Acceptance and tests

Wiremock verifies all six operations, create/update/validate request types, configuration read from file/stdin, successful and failed validation, nullable/absent response fields, and error output. Minimal and maximal fixtures cover every chart family and the newly added formulas/filter-variable fields without lossy round trips. README shows validate-then-create and update workflows.

Implementation conventions: place clap definitions, request builders, CloudClient wrappers and dispatch in the owning CLI domain; map library errors through CloudClient with organization context. Classify writes exhaustively and fail fast for OAuth writes. Preserve --json/agent output, tolerate missing response fields, and use print_human for detail output. Add README examples. Update both CI classifiers for new files. Validate parsing and minimal/maximal builders, real-binary wiremock auth/request/error/output paths, cargo fmt, default and telemetry-disabled Clippy/check, and tests for every touched crate.