feat(cli): add api passthrough, chat streaming, doctor warn status

Close the v0.2 RAG demo loop and ship the validation infrastructure:

  - weknora api <method> <path> [--data X | --data-file F]
      Raw passthrough wrapping client.Raw, gh-style. JSON envelope mode
      surfaces status / headers / parsed body. Non-2xx routes through
      cmdutil.ClassifyHTTPStatus (factored out of ClassifyHTTPError so
      both SDK-error and direct-status paths stay aligned — reuse review).

  - weknora chat <text> [--session-id S] [--no-stream]
      KnowledgeQAStream consumer with two output modes:
        - TTY default: token streaming + references footer
        - --json / --no-stream / non-TTY: buffered single envelope
      Auto-creates a session when --session-id is omitted; the id prints
      to stderr at start AND on stream failure (^C scrolls past the
      first announcement, so the recovery hint is re-surfaced when the
      user is most likely to need it).

  - cli/internal/sse/Accumulator
      buffers Content / References / SessionID across SDK callbacks.
      Idempotent post-Done so misbehaving servers don't corrupt state.

  - doctor: ok → ok / warn / fail / skip
      warn marks soft issues that don't block: server within compat range
      but >=1 minor behind CLI; credential storage falling back to file
      because keyring is unavailable. Envelope.ok stays true on warn,
      flips false on fail (exit 1). doctor.error_network golden updated.

  - cli/acceptance/e2e/    real-server RAG full loop
      Build-tagged //go:build acceptance_e2e — kept out of the default
      `go test ./...`. Exercises kb create → doc upload → poll ready →
      search → chat → cleanup against a server pointed at by
      WEKNORA_E2E_HOST / _TOKEN.

  - .github/workflows/cli-e2e.yml
      manual workflow_dispatch + label-gated PR trigger
      ("acceptance-e2e"). No-ops gracefully when the secrets aren't set
      so cross-fork PRs can't accidentally fail the suite.

.github/workflows/cli-e2e.yml

@@ -0,0 +1,66 @@
+name: CLI E2E
+
+# Runs the cli/acceptance/e2e/ suite against a real WeKnora server.
+# Cost-gated so it doesn't fire on every PR:
+#   - workflow_dispatch: maintainer can trigger manually
+#   - pull_request labeled "acceptance-e2e": adding the label kicks a run
+#
+# Required repo secrets (only set on Tencent/WeKnora; cross-fork PRs have no
+# access and the job exits early via the secrets-present guard):
+#   WEKNORA_E2E_HOST   - https URL of the test server
+#   WEKNORA_E2E_TOKEN  - bearer token / API key for that host
+#
+# Mirrors gh acceptance/ trigger pattern: env-gated, opt-in, single matrix.
+
+on:
+  workflow_dispatch:
+  pull_request:
+    types: [labeled, synchronize]
+    paths:
+      - 'cli/**'
+      - '.github/workflows/cli-e2e.yml'
+
+defaults:
+  run:
+    working-directory: cli
+    shell: bash
+
+permissions:
+  contents: read
+
+jobs:
+  e2e:
+    name: rag full loop
+    # Skip auto-trigger on label-add unless the label is exactly "acceptance-e2e".
+    # Manual workflow_dispatch always runs.
+    if: |
+      github.event_name == 'workflow_dispatch' ||
+      (github.event_name == 'pull_request' && contains(github.event.pull_request.labels.*.name, 'acceptance-e2e'))
+    runs-on: ubuntu-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v6
+      - uses: actions/setup-go@v6
+        with:
+          go-version: '1.24'
+          cache-dependency-path: cli/go.sum
+
+      - name: secrets present
+        id: secrets
+        env:
+          E2E_HOST: ${{ secrets.WEKNORA_E2E_HOST }}
+          E2E_TOKEN: ${{ secrets.WEKNORA_E2E_TOKEN }}
+        run: |
+          if [ -z "$E2E_HOST" ] || [ -z "$E2E_TOKEN" ]; then
+            echo "::warning::WEKNORA_E2E_HOST or WEKNORA_E2E_TOKEN not set; skipping e2e."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - name: go test -tags=acceptance_e2e
+        if: steps.secrets.outputs.skip == 'false'
+        env:
+          WEKNORA_E2E_HOST: ${{ secrets.WEKNORA_E2E_HOST }}
+          WEKNORA_E2E_TOKEN: ${{ secrets.WEKNORA_E2E_TOKEN }}
+        run: go test -tags=acceptance_e2e -v -timeout=8m ./acceptance/e2e/...