feat(cli): add Service Account commands

[mbevc1]

Add CLI commands wrapping the new service account management endpoints (kosli-dev/server#5951): create, list, get, update and delete service accounts. Previously the CLI could only manage a service account's API keys, not the accounts themselves.

• create/list/get/delete added under the existing verbs
• update added under a new update parent command (registered in root)
• shared models and table printers in serviceAccount.go, mirroring apiKey.go
• httpfake-backed tests plus response fixtures under testdata/service-account

[claude]

Claude finished @mbevc1's task in 2m 46s —— View job

---

Claude Code Review — Service Account commands

• Phase 1: Static analysis (go build, go vet, go mod tidy)
• Phase 2: Read changed files & review
• Phase 3: Post findings

---

Static analysis ✅

• go build ./... — clean
• go vet ./... — clean
• go mod tidy → go.mod/go.sum unchanged
• (Could not run the integration test suite — it needs the local Kosli server, and go test isn't in the allowed tools for this run. The unit-level table tests and httpfake suites look self-contained and should pass.)

Overall

This is a clean, well-structured addition that closely mirrors the existing apiKey.go patterns. Verb registration, flag conventions, dry-run handling, and output.FormattedPrint wiring are all consistent with the rest of cmd/kosli/. The two earlier review threads (privilege discoverability) are resolved. Nothing blocking — comments below are minor/optional.

What's well done 👍

• Thorough, layered tests — dry-run URL/payload assertions, httpfake happy-path for all verbs, 4xx surfacing, and the multi-name partial-failure path with "already deleted before this failure" reporting. That partial-failure handling (deleteServiceAccount.go:89-117) is a thoughtful touch for a destructive, non-idempotent operation.
• update uses a map[string]interface{} keyed off cmd.Flags().Changed(...) (updateServiceAccount.go:73-79) so an omitted flag is truly omitted while --description "" can still explicitly clear the field — the right PATCH semantics, and distinct from create's omitempty struct.
• Single source of truth for the privilege list (validServiceAccountPrivilegesList) reused in the help text, plus clear long-descriptions and examples on every command.
• Good empty/N/A description handling in both table printers, exercised by dedicated unit tests.

Minor / optional observations

1. List pagination — listServiceAccounts.go fetches api/v2/service-accounts/{org} with no page/interval flags. This matches listApiKeys.go, so it's consistent; just flagging that if the server ever paginates this endpoint, only the first page would render. Fine to leave as-is given the sibling pattern.
2. list singular alias — listServiceAccounts registers service-account (singular) as an alias alongside sa/sas. Harmless, but it means kosli list service-account and kosli get service-account look near-identical while doing different things. Optional to drop the singular alias for clarity.
3. Identical fixtures — created_service_account.json and service_account.json are byte-identical (same blob SHA). Intentional and harmless; just noting in case one was meant to differ (e.g. a different created_at).
4. The two error fixtures referenced by the suite (error_service_account_not_found.json, error_forbidden.json) exist in the testdata dir but aren't in this PR's changed-files list — confirmed present, so tests won't break.

Nice work — this reads like it belongs in the codebase.
• 20260625_cmd_sa