Add company forms, signatories, and federal-tax read commands

[ashieh]

What

Adds first-class read commands under company for data that was previously only reachable through the raw gusto api escape hatch:

Command	Endpoint
company forms list	GET /v1/companies/{uuid}/forms
company forms show <form_uuid> (alias get)	GET /v1/forms/{uuid}
company forms pdf <form_uuid>	GET /v1/forms/{uuid}/pdf
company signatories	GET /v1/companies/{uuid}/signatories
company federal-taxes	GET /v1/companies/{uuid}/federal_tax_details

forms is a nested sub-group (list/show/pdf) since it has multiple operations; signatories and federal-taxes are single-op and stay flat, mirroring company locations.

Scopes

Adds the matching read scopes to required-scopes.ts: company_forms:read, signatories:read, company_federal_taxes:read. These are read-only and do not overlap with the dropped write/manage scopes.

Notes

• The two collection reads (forms list, signatories) guard against a non-array 2xx body with malformed_response, matching the existing collection-read convention. federal-taxes returns a single object, so it has no array guard.
• All uuids are percent-encoded into a single path segment.

Testing

• Unit tests for all five handlers, including the malformed-body path for the two lists.
• required-scopes test asserts the three new scopes are present and not dropped.
• Smoke tests assert each command dispatches (reaches the auth check) in the compiled binary.
• Verified live against the demo environment: all five commands return real data (2 forms with a working PDF link, 1 signatory, populated federal tax details).

[tmfahey]

forms list and signatories hit fetchCompanyResource with no --cursor/--limit/--all — every other company-scoped collection endpoint here (contractor list, employee list) goes through parsePaginationFlags + ctx.client.paginate. If a company's got more forms or signatories than fit in one page, this silently returns page one with no next and no signal anything's missing. company locations skips pagination too, but that's a naturally small list — forms can pile up over years. Worth wiring the same pagination flags in, or confirming with the API that these two never paginate.

[ashieh]

Fixed in 96ac7c4. forms list now goes through parsePaginationFlags + ctx.client.paginate with --cursor/--limit/--all (matching employee/contractor list) and surfaces next. I confirmed with the API: the company forms index paginates server-side (its controller calls paginate(...)), so a single un-paged GET was a real silent-truncation risk. Signatories I left un-paginated on purpose: that endpoint does not paginate and the API caps a company at one signatory, so there is no page to drop.

[tmfahey]

None of the five new handlers gets a non-2xx test — this file only covers the happy path plus the malformed-body case for the two array endpoints. company.network.test.ts and employee.network.test.ts both test the 404/500 → ApiError → exit code mapping per handler; this is the first batch of new handlers in a while that skips it.

[ashieh]

Added in 96ac7c4. Each of the five new handlers now has a non-2xx spec asserting the ApiError maps to a failed result with the api-client exit code (ExitCode.ApiClient). I used 404 rather than 500 because a persistent 500 trips the client's real retry backoff and hangs the test; 404 exercises the same ApiError to exit-code path. The forms-list case also gained a --limit cap test and a --cursor + --all conflict test.

[tmfahey]

companyFormShowHandler/companyFormPdfHandler call fetchResource(...) untyped, so result.data stays unknown. fetchResource<T> already supports a type param and companyShowHandler above uses it (ctx.client.get<CompanyRecord>) — worth typing these two the same way.

[ashieh]

Done in 96ac7c4. Both now pass the type param: fetchResource<FormRecord> for show and fetchResource<FormPdfUrl> for pdf, so result.data is typed instead of unknown. The field shapes come from the forms presenter (title/type/year/quarter/requires_signing/document_url, etc.).