feat(cli): JSON Schema generation + IDE autocomplete support

[Destynova2]

Summary

• Adds grob schema subcommand that prints a JSON Schema (Draft 7) for ~/.grob/config.toml, generated from JsonSchema-decorated config structs in src/cli/config/. Operators editing the file get autocomplete, hover docs, and inline type errors in VS Code (Even Better TOML), JetBrains, Neovim (taplo / coc-toml), and Helix.
• Pre-generated schemas/grob-config.schema.json checked into the repo, kept in sync by a new CI job schema-up-to-date that fails any PR where the committed schema drifts from the code.
• Workspace .vscode/settings.json wires the schema in for contributors editing project configs; docs/how-to/ide-autocomplete.md covers VS Code / JetBrains / Neovim / Helix / CLI validation setups for end users.

Implementation notes

• schemars = "0.8" added to Cargo.toml. All structs in src/cli/config/*.rs plus the Port / BudgetUsd / BodySizeLimit newtypes derive JsonSchema. SecretString fields use #[schemars(with = \"Option<String>\")] so the schema describes them as opaque strings (literal value, \$ENV_VAR, or secret:<name>).
• AppConfig is mirrored by a SchemaAppConfig wrapper in src/cli/config/schema.rs. Sections that live in cross-cutting feature modules (dlp, mcp, policies, tap, auth, tool_layer, log_export, pledge, classifier) are surfaced as serde_json::Value placeholders so future feature blocks remain valid without forcing a JsonSchema derive on every internal feature module. The well-known sections (server, router, providers, models, tiers, presets, budget, security, cache, secrets, compliance, otel, tee, fips, user, harness) are fully typed.
• grob schema is short-circuited in main.rs before config loading runs, so it works on a freshly cloned machine with no ~/.grob/config.toml.
• Enum variants render as JSON Schema oneOf (verified for AuthType -> apikey/oauth, SecretsBackend -> local_encrypted/env/file, EnforcementMode, ModelStrategy, FanOutMode, PoolStrategy).

Test plan

• cargo nextest run --lib -> 1060 / 1060 pass, including 7 new tests covering schema generation + the cmd_schema command.
• cargo test --doc -> doctest for cli::schema::generate compiles.
• cargo fmt --all -- --check clean.
• cargo clippy --all-targets -- -D warnings clean (default + CI feature subset + harness feature).
• cargo run --bin grob -- schema | jq . -> valid JSON, 33 named definitions, all 26 top-level config sections present.
• diff schemas/grob-config.schema.json <(grob schema) -> empty (CI guard verified locally before push).
• CI green (release-plz path filter ignores schemas/ so this PR will not bump the version; release-plz runs only on src/**, Cargo.toml, Cargo.lock -> the release path triggers as expected since Cargo.toml and Cargo.lock changed).
• Manual: open ~/.grob/config.toml in VS Code with Even Better TOML installed, hover [server] field -> description renders.

🤖 Generated with Claude Code