refactor: migrate commands::clinicians to ApiClient

[shadowhand]

Summary

Stacked on #80.

Folds the clinician-side raw-reqwest helpers into ApiClient calls and switches every command to deserialize via jsonapi::Single / jsonapi::List. Net: −365 LOC.

Before / after the typical command

// Before
let auth_header = crate::commands::auth::require_auth(ctx).await?;
let client = Client::new();
let url = format!("{}/clinicians/{}", base_url.trim_end_matches('/'), uuid);
let body = serde_json::json!({ "data": { "type": "clinicians", ... } });
let req = apply_auth(client.patch(&url), auth_header).json(&body);
let resp = req.send().await.context("PATCH /clinicians failed")?;
let status = resp.status();
let body = resp.text().await.context("failed to read response body")?;
if !status.is_success() { bail!("API returned {}: {}", status, body); }
let response: ClinicianSingleResponse = serde_json::from_str(&body)
    .context("failed to parse clinician response")?;

// After
let api = ApiClient::new(ctx).await?;
let body = serde_json::json!({ "data": { "type": "clinicians", ... } });
let resp: Single<ClinicianAttributes> =
    api.patch(&format!("clinicians/{}", uuid), &body).await?;

File-level changes

• data.rs (30 → 17): dropped ClinicianResource / ClinicianListResponse / ClinicianSingleResponse; added type Clinician = Resource<ClinicianAttributes>.
• client.rs (177 → 75): every helper now takes &ApiClient instead of (&Client, &str, &str). apply_auth deleted (the client attaches auth itself).
• commands::roles::resolve_role: signature changed to (&ApiClient, &str). The "legacy helper" docstring is removed since it no longer is one.
• grant, assign, enable, show, update, register, prepare: each command now opens with let api = ApiClient::new(ctx).await?; and uses api.get/patch/post. Per-command patch_clinician_* helpers deleted; bodies inlined at the call site since they're each used once.
• prepare.rs: workspace POSTs use api.post_void (no response body to parse).

Stack ahead

6. Split commands/config.rs into a module
7. Move dispatch into per-subcommand modules
8. Extract Stage + slug to a domain module
9. CI hardening

Test plan

• cargo fmt --check clean
• cargo clippy --all-targets — same 11 pre-existing warnings, none from changes
• cargo test — 288 pass total (270 lib + 7 bin + 11 integration), unchanged

https://claude.ai/code/session_012fVDyKBysF1ERtvVuEAw2Y

---

Generated by Claude Code

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no potential bugs to report.

View in Devin Review to see 2 additional findings.