fix: correct API issues found by codex review across 10 CLIs

Fixes found by automated codex review of all 47 CLI tools:

- resend: webhook field name endpoint_url -> endpoint
- mailchimp: change from Bearer to Basic auth per API docs
- kit: fail fast when api_secret required but not set
- activecampaign: automation add-contact needs --contact-id not --email
- google-ads: budget updateMask must be snake_case (amount_micros)
- meta-ads: special_ad_categories default to ['NONE'] not empty array
- linkedin-ads: add required X-RestLi-Protocol-Version header
- onesignal: auth prefix should be Key, not Basic
- mixpanel: query dates must be YYYY-MM-DD, not relative strings
- wistia: change from Bearer to Basic auth per API docs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tools/clis/activecampaign.js

@@ -273,11 +273,11 @@ async function main() {
         }
         case 'add-contact': {
           const automationId = args.id
-          const contactEmail = args.email
+          const contactId = args['contact-id']
           if (!automationId) { result = { error: '--id required (automation ID)' }; break }
-          if (!contactEmail) { result = { error: '--email required' }; break }
+          if (!contactId) { result = { error: '--contact-id required (contact ID, not email)' }; break }
           result = await api('POST', '/contactAutomations', {
-            contactAutomation: { contact: contactEmail, automation: automationId }
+            contactAutomation: { contact: contactId, automation: automationId }
           })
           break
         }