feat(provider): import API contracts and wait for publication

[AmazingAng]

Providers can import an OpenAPI document, configure the returned draft revision, submit it for review, and wait for the publication result entirely through the CLI.

Add provider spec-rules, import, submit, wait, update --revision, and review --revision. Existing metadata/rate-limit updates, version management, publish, rollback, metrics, and skill commands retain their interfaces. Import returns service/revision IDs and preserves structured validation failures even when the server responds with HTTP 201. Polling succeeds only for PUBLISHED and bounds requests and retry delays by its deadline; writes are never automatically retried.

Provider output redacts credentials while retaining JSON Schema definitions such as token/password properties. The refreshed implementation also prevents raw HTTP error bodies and malformed private-header JSON fragments from leaking credential values, rejects blank resource identifiers, and enforces the backend's 2,000-character changelog limit. Add explicit endpoint merge/replacement controls, stdin support, an OpenAPI example, workflow documentation, and regression coverage.

Backend contract status:

• Backend integration PR https://github.com/xapi-labs/xapi-backend/pull/143 merged the current Provider contract.
• Backend release PR https://github.com/xapi-labs/xapi-backend/pull/160 promoted it to main.
• A read-only production request to /api/api-services/agent/spec-rules returned HTTP 200 and confirmed the example's OpenAPI 3.0.3, Public-Utils, and PER_CALL values.

Validation on the refreshed branch:

• bun install --frozen-lockfile passed.
• bun run typecheck passed.
• bun run build passed.
• bun run test passed: 354 tests across 25 files.
• npm pack --dry-run --ignore-scripts passed and includes the Provider example and bundled skills.
• git diff --check passed.

These are local build/package checks, mocked HTTP tests, and a read-only production contract check. No live Provider import or other production write was performed, and this PR does not publish npm. Package versions and release notes remain controlled by Release Please.

Kanby-Task: KANBY-45