fix: correct API issues found by codex review across 10 CLIs

Fixes found by automated codex review of all 47 CLI tools:

- resend: webhook field name endpoint_url -> endpoint
- mailchimp: change from Bearer to Basic auth per API docs
- kit: fail fast when api_secret required but not set
- activecampaign: automation add-contact needs --contact-id not --email
- google-ads: budget updateMask must be snake_case (amount_micros)
- meta-ads: special_ad_categories default to ['NONE'] not empty array
- linkedin-ads: add required X-RestLi-Protocol-Version header
- onesignal: auth prefix should be Key, not Basic
- mixpanel: query dates must be YYYY-MM-DD, not relative strings
- wistia: change from Bearer to Basic auth per API docs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

tools/clis/kit.js

@@ -14,6 +14,8 @@ async function api(method, path, body, useSecret = true) {
   if (method === 'GET' || method === 'DELETE') {
     if (useSecret && API_SECRET) {
       url.searchParams.set('api_secret', API_SECRET)
+    } else if (useSecret && !API_SECRET) {
+      return { error: 'KIT_API_SECRET required for this endpoint' }
     } else if (API_KEY) {
       url.searchParams.set('api_key', API_KEY)
     }
@@ -26,6 +28,8 @@ async function api(method, path, body, useSecret = true) {
     const authBody = { ...body }
     if (useSecret && API_SECRET) {
       authBody.api_secret = API_SECRET
+    } else if (useSecret && !API_SECRET) {
+      return { error: 'KIT_API_SECRET required for this endpoint' }
     } else if (API_KEY) {
       authBody.api_key = API_KEY
     }