fix: add input validation and safe JSON parsing across 13 CLIs

Add missing parameter validation to prevent /path/undefined API calls:
- dub: require --url for links create
- google-search-console: require --sitemap-url for sitemaps submit
- kit: validate IDs and emails for subscribers, forms, sequences, tags, broadcasts
- mailchimp: validate IDs for lists get, campaigns get/create/send, members add, reports get
- resend: validate --from/--to/--subject for send, audience/contact IDs for contacts
- rewardful: validate IDs for affiliates get/update, commissions get, links create
- semrush: require --domain/--phrase for all domain and keyword commands
- sendgrid: validate --from/--to/--subject for send, campaign IDs, email for validate

Wrap bare JSON.parse() calls in try/catch for user-provided JSON:
- dub (--links), ga4 (--params), kit (--fields x4), mixpanel (--properties x2),
  onesignal (--filters), paddle (--scheduled-change, --items x2),
  resend (--emails, --variables x2), segment (--properties, --traits, --events),
  sendgrid (--template-data)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tools/clis/paddle.js

@@ -203,7 +203,9 @@ async function main() {
           if (!id) { result = { error: '--id required' }; break }
           const body = {}
           if (args['proration-billing-mode']) body.proration_billing_mode = args['proration-billing-mode']
-          if (args['scheduled-change']) body.scheduled_change = JSON.parse(args['scheduled-change'])
+          if (args['scheduled-change']) {
+            try { body.scheduled_change = JSON.parse(args['scheduled-change']) } catch { result = { error: 'Invalid JSON in --scheduled-change' }; break }
+          }
           result = await api('PATCH', `/subscriptions/${id}`, body)
           break
         }
@@ -248,7 +250,9 @@ async function main() {
         case 'create': {
           const items = args.items
           if (!items) { result = { error: '--items required (JSON array of {price_id, quantity})' }; break }
-          const body = { items: JSON.parse(items) }
+          let parsedItems
+          try { parsedItems = JSON.parse(items) } catch { result = { error: 'Invalid JSON in --items' }; break }
+          const body = { items: parsedItems }
           if (args['customer-id']) body.customer_id = args['customer-id']
           result = await api('POST', '/transactions', body)
           break
@@ -304,11 +308,13 @@ async function main() {
           if (!action) { result = { error: '--action required (refund, credit, chargeback)' }; break }
           if (!reason) { result = { error: '--reason required' }; break }
           if (!items) { result = { error: '--items required (JSON array of {item_id, type, amount})' }; break }
+          let parsedItems
+          try { parsedItems = JSON.parse(items) } catch { result = { error: 'Invalid JSON in --items' }; break }
           result = await api('POST', '/adjustments', {
             transaction_id: transactionId,
             action,
             reason,
-            items: JSON.parse(items),
+            items: parsedItems,
           })
           break
         }