WVDSH-2269: add leaderboard list, create, and update commands

[franzwarning]

Linear: WVDSH-2269 — create and update leaderboards from the CLI.

Requires the backend in https://github.com/wvdsh/wavedash/pull/1232 for list and create; update uses the PATCH endpoint that's already live.

Commands

wavedash leaderboard list [--json]
wavedash leaderboard create --name <NAME> --display-name <TEXT> [--sort-order desc|asc] [--display-type numeric|seconds|milliseconds|game-ticks] [--hidden]
wavedash leaderboard update (--id <ID> | --name <NAME>) [--display-name <TEXT>] [--sort-order ...] [--display-type ...] [--hidden true|false]

• All three accept --game-id / WAVEDASH_GAME_ID / wavedash.toml like the stat and achievement commands.
• create defaults match the Developer Portal: desc (higher is better), numeric, visible. --hidden / --hidden <bool> follow achievement's --secret flag-on-create, value-on-update pattern; the CLI maps it onto the API's visible.
• update requires exactly one of --id/--name (a clap group), sends only the flags passed, and refuses an empty update locally. Names are percent-encoded into the by-name path segment.
• list follows nextCursor until every page is fetched.
• check_api_response used to turn every JSON 404 into "Game not found… run wavedash init". It now does that only when the API says Game not found, so leaderboard update --name typo prints Leaderboard not found (the build-status route's "Build not found in this game" 404 had the same problem).

Demo (real dev deployment)

Desktop: commands in the terminal panel at the bottom drive the Developer Portal, which updates live.

▶ desktop.mp4

Mobile: update --sort-order asc re-ranks the scores on the game page, then --hidden true hides the board.

▶ mobile.mp4

Desktop	Mobile

Error paths (real output):

Testing

• Unit tests for API enum values, update_url encoding, update_body field selection, response parsing/round-trip, the --id/--name group, and create defaults. cargo test: 87 passed. cargo clippy --all-targets: clean. Touched code is rustfmt-clean (main already has unrelated drift in build.rs/config.rs, left alone).
• Built with CONVEX_HTTP_URL pointed at the dev deployment and ran list/create/update (by name and by ID), --json, a duplicate create, an unknown name, a malformed ID, an empty update, and --id + --name together.

No version bump. That's left for the release.

🤖 Generated with Claude Code

[devin-ai-integration]

✅ Devin Review: No Issues Found

Devin Review analyzed this PR and found no bugs or issues to report.