feat: add workflow management and enrollment commands

[rianjs]

Summary

Extend workflow API and CLI with CRUD operations and enrollment management.

API Layer (api/automation.go)

• CreateWorkflow(data) - create a new workflow from JSON
• UpdateWorkflow(id, data) - update an existing workflow
• DeleteWorkflow(id) - delete a workflow by ID
• EnrollInWorkflow(workflowId, objectId) - enroll an object in a workflow
• ListWorkflowEnrollments(workflowId, opts) - list enrolled objects with pagination
• WorkflowEnrollment and WorkflowEnrollmentList types

CLI Commands

• hspt workflows create --file workflow.json - create workflow from JSON file
• hspt workflows update <id> --file workflow.json - update existing workflow
• hspt workflows delete <id> - delete a workflow
• hspt workflows enroll <workflowId> --object-id <objectId> - enroll object in workflow
• hspt workflows enrollments <workflowId> - list workflow enrollments

Tests

• Comprehensive API tests in api/automation_test.go
• Tests for Create, Update, Delete, Enroll, and ListEnrollments operations
• Tests cover success cases, empty results, and validation errors

Test Plan

• make build passes
• make test passes
• make lint passes
• API tests cover all new operations

Closes #26

[rianjs]

Test Coverage Assessment for TDD

I've analyzed the test coverage for the workflow management and enrollment commands. Here's my assessment:

API Layer: Adequate for TDD

The tests in api/automation_test.go cover all 7 new functions with appropriate patterns:

• ListWorkflows: success + empty results
• GetWorkflow: success + not found + empty ID validation
• CreateWorkflow: success only
• UpdateWorkflow: success + empty ID validation
• DeleteWorkflow: success + empty ID validation
• EnrollInWorkflow: success + empty workflow ID + empty object ID
• ListWorkflowEnrollments: success + empty workflow ID + empty results

This matches the established patterns in crm_test.go and other API test files.

Potential Gaps (non-blocking)

1. Missing error cases for mutating operations:

   • CreateWorkflow lacks a 400 Bad Request test (e.g., invalid workflow definition)
   • DeleteWorkflow lacks a not-found test (though GetWorkflow has one)

2. No malformed response tests - none of the API methods test JSON parse error paths

3. CLI layer has no tests - but this is consistent with the entire codebase (internal/cmd/* packages all show [no test files])

Verdict: Coverage is sufficient

For TDD purposes, the coverage is adequate. The API layer tests:

• Verify correct HTTP methods and paths
• Validate query parameters and request bodies
• Parse response structures correctly
• Test input validation (empty ID checks)
• Cover pagination scenarios

The gaps noted are minor and don't block a TDD workflow - they could be addressed in a follow-up if desired. The CLI layer testing gap is an architectural decision that appears intentional across this project (thin CLI layer with logic concentrated in the testable API layer).