payroll list: validate date range before the API 422s

[tmfahey]

Summary

payroll list --start-date/--end-date was passed straight through to GET /v1/companies/{id}/payrolls, which 422s when the range spans more than a year or end-date is more than 3 months out. This validates both rules client-side and returns a blocked_on entry instead, so the failure is deterministic and actionable before the request goes out.

Test plan

• bun run test:all passes locally
• Manual run of touched commands works against sandbox
• --agent and --human output verified where touched

Ran the built binary (dist/gusto payroll list) directly, unauthenticated, against the exact >1yr-apart range from the repro, the >3mo-future case, and both combined; each returns the expected blocked_on entry in both --agent and human output. A valid range still passes validation through to the correct no_access_token error rather than reaching the API, so no live sandbox call was made.

DCO

• Every commit is signed off (git commit -s) per the DCO

[azrosen92]

I'm a bit wary of reproducing backend/validation logic on a thin wrapper around the API. That logic could easily change, and keeping this business logic in sync with the API's logic is not trivial. What was the motivation for doing this?