feat(cli): search, messages send, webhook verify, sso verify

The CLI now covers the whole Redmine 507 surface: `search TERM
[-page N]` (operators pass through quoted), `messages send -title
-to user1,user2 [-group/-email] [-file|-raw]`, plus the two secret
helpers `webhook verify SIG` (delivery body on stdin, exit 0 only
on a valid HMAC) and `sso verify SSO SIG` (prints the decoded
Discourse Connect payload as JSON). The helpers run before client
construction so they work with only their secret env set, no
instance credentials needed. Usage text lists the new env vars.

Part of Redmine 507 (Discourse Go client).

cmd/discourse-go/main.go

@@ -29,12 +29,18 @@ Usage:
   discourse-go topics create -title TITLE -category ID [-file PATH | -raw TEXT]
   discourse-go posts create -topic ID [-file PATH | -raw TEXT]
   discourse-go posts update ID [-file PATH | -raw TEXT] [-reason TEXT]
+  discourse-go search TERM [-page N]
+  discourse-go messages send -title TITLE -to USER[,USER...] [-file PATH | -raw TEXT]
+  discourse-go webhook verify SIG            (delivery body on stdin)
+  discourse-go sso verify SSO SIG            (Discourse Connect payload check)
   discourse-go raw METHOD PATH [-data JSON]
 
 Environment (0600 env file, sourced before the call):
   DISCOURSE_URL            instance root, e.g. https://community.turnsys.com
-  DISCOURSE_API_KEY        API key (never a flag, never logged)
+  DISCOURSE_API_KEY        API key (DISCOURSE_KEY works too; never a flag, never logged)
   DISCOURSE_API_USERNAME   the user the key acts as (default: system)
+  DISCOURSE_WEBHOOK_SECRET webhook signature secret (webhook verify)
+  DISCOURSE_SSO_SECRET     Discourse Connect secret (sso verify)
 
 Perm levels: 1 = reply/see, 2 = create posts, 3 = full.
 raw PATH is everything after the instance root, e.g. /groups.json.
@@ -54,6 +60,15 @@ func run(args []string) int {
 	ctx, stop := signal.NotifyContext(context.Background(), os.Interrupt, syscall.SIGTERM)
 	defer stop()
 
+	// Secret-helper commands never touch an instance: run them before
+	// client construction so they work without DISCOURSE_URL/DISCOURSE_API_KEY.
+	switch args[0] {
+	case "webhook":
+		return runWebhook(args[1:])
+	case "sso":
+		return runSSO(args[1:])
+	}
+
 	client, err := discourse.NewFromEnv()
 	if err != nil {
 		fmt.Fprintf(os.Stderr, "discourse-go: %v\n", err)
@@ -74,6 +89,10 @@ func run(args []string) int {
 		out, err = runTopics(ctx, client, args[1:])
 	case "posts":
 		out, err = runPosts(ctx, client, args[1:])
+	case "search":
+		out, err = runSearch(ctx, client, args[1:])
+	case "messages":
+		out, err = runMessages(ctx, client, args[1:])
 	case "raw":
 		out, err = runRaw(ctx, client, args[1:])
 	case "help", "-h", "--help":