feat: cover remaining documented Platform API endpoints

[priosshrsth]

Adds the 24 operations that are in Assembly's published OpenAPI spec but were missing from the kit, taking coverage from 73 to 97 of 99. Gaps were found by diffing /docs/api-reference/openapi.json against every #transport.* call in src/; the same diff confirms no kit method points at a route the spec no longer has.

New namespaces: me, refunds, taskComments. The rest are methods on existing namespaces — see the updated tables in README.md and CLAUDE.md.

Not included: POST /v1/session and POST /v1/token. Both mint bearer tokens, and the kit authenticates every request with X-API-Key: workspaceId/apiKey — whether a minted bearer replaces that header, coexists with it, or is handed back to the caller is a design decision, not a resource method. /v1/session also has no published doc page, only a spec entry.

What to look at

• src/transport/http.ts — new getRaw(). GET /v1/files/{id}/download streams application/octet-stream, so it can't go through .json(). Check the error mapping still applies (it shares withErrorMapping).
• src/lib/modules/clients/schema.ts — ClientSchema now builds from a shared clientShape so ClientWithAppVisibilitySchema can reuse it without duplicating 18 fields. Verify the refactor didn't change what ClientSchema accepts.
• src/lib/modules/files/schema.ts — clientPermissions is modelled as "read_only" | "read_write", deliberately deviating from the spec, which declares that enum as one string, "read_only read_write". Worth a second opinion on whether that's a spec bug or a real wire format.
• src/lib/modules/forms/schema.ts — Form gained fields/additionalFields. The create request needs them typed anyway, and they were previously being stripped from every form response.

Verified / not verified

vp check and vp pack clean; 191 tests pass (19 new in tests/resources.test.ts, asserting method, exact pathname, query params, and body per endpoint). Mutating four route strings was confirmed to fail the suite, so the assertions aren't vacuous.

No request hit the real API — all 24 endpoints are exercised through an injected mock fetch. Response schemas are therefore typed from the spec but unverified against live payloads; appVisibility is typed loosely (Record<string, unknown>[]) because Assembly documents the field in prose but omits it from the OpenAPI response schema.

[priosshrsth]

Pushed 9440826 onto this branch — an enum audit against the published spec, prompted by Sentry C1-APP-3 (170 events in c1-api).

Every z.enum in the SDK was diffed against the spec. Four were narrower than the API, and because these are response schemas a single unlisted value throws AssemblyResponseParseError for the entire payload — one client with an undocumented status discards every client in the page.

schema	change	evidence
Client.status	+ unknown, deleted	spec api.ClientItem.status lists 5; SDK had 3 — this is C1-APP-3
Client.creationMethod	+ import	spec api.ClientItem.creationMethod
InvoiceStatus	+ processing	spec invoice.Invoice.status
TaskStatus	done → completed	not in spec, and the live API never sends it

TaskStatus is breaking for anyone matching on "done". It's a correction, not a widening: the spec lists todo\|inProgress\|completed in both TaskInput and the /v1/tasks query parameter, and sampling the live API returned 45 completed / 6 todo and zero done. Every completed task would have failed to parse. Nothing in this repo or in c1-apps referenced the old value.

Two existing tests asserted the bug — one required completed to be rejected, and a TasksResponseSchema fixture used done. Both corrected.

CustomFieldEntityType also looked narrow but is right: the spec scopes it to client\|company.

vp check clean, 193 tests pass. c1-apps needs a published version before C1-APP-3 stops firing.