fix: add input validation and safe JSON parsing across 13 CLIs

Add missing parameter validation to prevent /path/undefined API calls:
- dub: require --url for links create
- google-search-console: require --sitemap-url for sitemaps submit
- kit: validate IDs and emails for subscribers, forms, sequences, tags, broadcasts
- mailchimp: validate IDs for lists get, campaigns get/create/send, members add, reports get
- resend: validate --from/--to/--subject for send, audience/contact IDs for contacts
- rewardful: validate IDs for affiliates get/update, commissions get, links create
- semrush: require --domain/--phrase for all domain and keyword commands
- sendgrid: validate --from/--to/--subject for send, campaign IDs, email for validate

Wrap bare JSON.parse() calls in try/catch for user-provided JSON:
- dub (--links), ga4 (--params), kit (--fields x4), mixpanel (--properties x2),
  onesignal (--filters), paddle (--scheduled-change, --items x2),
  resend (--emails, --variables x2), segment (--properties, --traits, --events),
  sendgrid (--template-data)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tools/clis/mixpanel.js

@@ -118,7 +118,8 @@ async function main() {
           if (!TOKEN) { result = { error: 'MIXPANEL_TOKEN required for tracking' }; break }
           if (!args['distinct-id']) { result = { error: '--distinct-id required' }; break }
           if (!args.event) { result = { error: '--event required' }; break }
-          const properties = args.properties ? JSON.parse(args.properties) : {}
+          let properties
+          try { properties = args.properties ? JSON.parse(args.properties) : {} } catch { result = { error: 'Invalid JSON in --properties' }; break }
           properties.token = TOKEN
           properties.distinct_id = args['distinct-id']
           result = await ingestApi('POST', '/track', [{
@@ -137,7 +138,8 @@ async function main() {
         case 'set': {
           if (!TOKEN) { result = { error: 'MIXPANEL_TOKEN required for profiles' }; break }
           if (!args['distinct-id']) { result = { error: '--distinct-id required' }; break }
-          const properties = args.properties ? JSON.parse(args.properties) : {}
+          let properties
+          try { properties = args.properties ? JSON.parse(args.properties) : {} } catch { result = { error: 'Invalid JSON in --properties' }; break }
           result = await ingestApi('POST', '/engage', [{
             $token: TOKEN,
             $distinct_id: args['distinct-id'],