feat: add --dry-run flag to all 47 CLI tools

When --dry-run is passed, each CLI prints the HTTP request it would
make (method, URL, headers, body) without actually calling fetch().
Auth credentials are masked as "***" in the output.

Useful for verifying request shape and API endpoints without needing
real API keys or making actual API calls.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tools/clis/mailchimp.js

@@ -11,12 +11,16 @@ const dc = API_KEY.split('-').pop()
 const BASE_URL = `https://${dc}.api.mailchimp.com/3.0`
 
 async function api(method, path, body) {
+  const headers = {
+    'Authorization': `Bearer ${API_KEY}`,
+    'Content-Type': 'application/json',
+  }
+  if (args['dry-run']) {
+    return { _dry_run: true, method, url: `${BASE_URL}${path}`, headers: { ...headers, Authorization: '***' }, body: body || undefined }
+  }
   const res = await fetch(`${BASE_URL}${path}`, {
     method,
-    headers: {
-      'Authorization': `Bearer ${API_KEY}`,
-      'Content-Type': 'application/json',
-    },
+    headers,
     body: body ? JSON.stringify(body) : undefined,
   })
   const text = await res.text()