fix(wiki): purge through the plugin page actions and count reset deletions (#101)

Closes #99. Closes #100.

## #99 — purge used the core topic API

`deploy-wiki --stale-policy purge` deleted pages with `DELETE /api/v3/topics/{tid}`. On a NodeBB running `nodebb-plugin-westgate-wiki` that is refused for topics in wiki categories — revision history is plugin-owned — so every purge failed with HTTP 400 and the deploy exited 1.

Purge now goes through the plugin's own page actions:

1. `PUT /api/v3/plugins/westgate-wiki/page/tombstone`
2. `DELETE /api/v3/plugins/westgate-wiki/page/hard-purge`

in that order, because a page must be tombstoned before it can be purged. A page that is already gone answers 404 on the tombstone and is treated as a completed purge, as before.

**Archive was audited and needs no change.** It rewrites the page through `updatePost`, which is an ordinary post edit the plugin allows; only delete, restore, and purge are reserved to the page actions.

**The wiki home topic.** A namespace reset enumerates every topic in the category, including the home page, which the plugin excludes from tombstone, restore, and purge alike. Those are now skipped instead of aborting the reset. NodeBB answers 403 for that and for a token without purge privileges alike, and the response body cannot tell the two apart — what can is scope. A category where nothing at all could be deleted is a privilege problem, so the run still fails there rather than writing a manifest that claims a fresh start over pages that are all still present.

**The fakes.** Every fake NodeBB in `wiki_deploy_test.go` now goes through one constructor that refuses native topic mutation exactly the way the plugin does. The old fakes answered the core API, which is how a purge path that has never worked in production stayed green in CI.

## #100 — `stale: 0` above `purged: 1213`

The reset purge never went through stale computation, so the preview reported zero deletions on a run that would delete every topic in the managed categories.

Reset deletions are now counted in `stale`, which is the number callers word their destructive-policy warning around, and the summary gains a line naming the reset and how many of its targets the manifest has no record of writing:

```
stale:       1213
purged:      1213
namespace reset: 1213 (unrecognized: 13)
  unrecognized pages were not written by this deployer; recreating them is not possible
```

The unrecognized subset is the number worth surfacing, since those are the deletions a re-seed cannot undo. The `--reset-managed-namespaces` help text now says plainly that the flag deletes every page in the managed categories, not only the ones this deployer wrote.

`DeployResult` is exported so the console reads named fields instead of eleven positional ints.

## Verification

`go vet ./...` and `go test ./...` pass. New tests cover the plugin purge order, the already-missing page, the skipped undeletable topic, the per-category privilege failure, and the reset counts.Reviewed-on: #101

Co-authored-by: vickydotbat <vickydotbat@tutamail.com>

docs/agents/issue-tracker.md

@@ -57,28 +57,32 @@ preference — move it.
   so any non-interactive shell (every agent) hangs forever without
   `</dev/null`. Same trap on `tea issues create --description` and
   `tea pr create`.
-- **Apply / remove labels**: `tea api --method PATCH` on the issue, or
-  `tea api repos/ShadowsOverWestgate/sow-tools/issues/<number>/labels` endpoints.
-- **Org-level labels (`Kind/*`, `Priority/*`, `Reviewed/*`, `Status/*`)**: `tea
-  issues edit --add-labels` / `--remove-labels` do **not** apply these on tea
-  0.14.0, the version nixpkgs pins. Name resolution searches only this repo's
-  own label set, so an org label matches nothing and the command exits 0,
-  prints the issue, and changes nothing — no error, no warning. Repo-local
-  labels (`wayfinder:*`, `ready-for-agent`) are unaffected. PRs no-op the same
-  way. Upstream fixed it in v0.15 (`modules/task/labels.go` now also queries
-  `ListOrgLabels`), so this expires when tea is bumped; until then apply org
-  labels in the web UI. Note `tea labels` lists repo labels only, so it will
-  not show you the org set either — `tea api orgs/ShadowsOverWestgate/labels`
-  does.
-- **Verify every label change by re-reading it.** `tea issues ls -o json` has a
-  `labels` field; use it. A label command exiting 0 is not evidence it applied,
-  and assuming otherwise has already cost one investigation several wrong turns.
-  `tea issues edit --add-labels` works too, org-level labels (`Kind/*`,
-  `Priority/*`) included, but a read-back straight afterwards can still show
-  the old set — `tea issues ls` has returned stale labels for several seconds
-  after an edit that succeeded. Never conclude an edit failed from a single
-  immediate list; re-read after a pause, or use the `labels` endpoints above,
-  whose response *is* the resulting label set and needs no second call.
+- **Apply / remove labels**: `tea issues edit <number> --add-labels "Kind/Bug"`
+  (and `--remove-labels`). This handles org-level labels (`Kind/*`,
+  `Priority/*`, `Reviewed/*`, `Status/*`) from tea 0.15 onwards. On 0.14 it did
+  not: name resolution searched only this repo's own label set, so an org label
+  matched nothing and the command exited 0, printed the issue, and changed
+  nothing. Upstream fixed it in v0.15 (`modules/task/labels.go` also queries
+  `ListOrgLabels`). Note `tea labels` lists repo labels only and will not show
+  you the org set — `tea api orgs/ShadowsOverWestgate/labels` does.
+- **`tea api` needs a token in the login; SSH auth is not enough.** It sends
+  only the login's `token:` field and does not sign requests with your SSH key,
+  so an SSH-key-only login gets `{"message":"token is required"}` on every call
+  that needs auth. Reads against these public repos still succeed anonymously,
+  which hides the gap until the first write. Add a token to the login in
+  `~/.config/tea/config.yml` (Settings > Applications; `write:issue` covers
+  labels, comments and dependencies) and `tea api` works for reads and writes
+  alike. The `tea issues` / `tea pr` subcommands authenticate either way, so
+  they keep working with no token at all — that asymmetry is what makes this
+  confusing to diagnose.
+- **Verify every label change by re-reading it.** A label command exiting 0 is
+  not evidence it applied — that is exactly how the 0.14 silent no-op above hid
+  for so long, and assuming otherwise has already cost one investigation
+  several wrong turns. Read the resulting set back with
+  `tea api repos/ShadowsOverWestgate/sow-tools/issues/<number>` and check its
+  `labels` field, or `tea issues ls -o json`. The read-back reflects the write
+  immediately; if it comes back empty, the write genuinely failed. Do not
+  explain an empty read-back away as replication lag.
 - **Close**: `tea issues close <number>`
 
 `tea` infers the repo from the git remote when run inside the clone.