feat(cli): add unpublish command and align publish with new API

[jheddings]

Summary

• Adds the everywhere unpublish command (DELETE /api/v1/app/:name)
• Updates publish to use the new POST /api/v1/apps/publish endpoint
• Switches publish body from multipart/form-data to raw application/zip
• Updates publish response shape from {id, referenceId, status, appType, creator} to {tenant, name, title, bundleUrl}

The name field from package.json is now the canonical plugin identifier across publish, unpublish, and bundle URLs — no UUID, no slug, no transformation.

unpublish reads the name from package.json in the current plugin directory, the same way publish does, so the CLI ergonomics match: run it from the plugin directory (or pass -D <plugin-dir>).

Breaking changes

• The publish response shape changed. Anyone parsing id / referenceId / status / appType / creator will need to migrate to the new shape.
• The publish request body is now a raw ZIP, not a multipart form.

Release

This change targets the next minor release: 0.3.0.

Test plan

• Registry uploadToRegistry tests cover URL, headers, body shape, and response parsing for the new contract
• Registry deleteFromRegistry tests cover URL, auth header, error paths
• publish command tests cover login required, missing manifest, success, and auth.https=false
• unpublish command tests cover login required, missing manifest, success, auth.https=false, and delete failure
• Full suite: 320 tests passing
• just check: typecheck + lint + format clean
• End-to-end verification against a live server with the matching API change once that lands