feat: add structured data and API interaction tools

[avoidwork]

Summary

Add a generic REST API client, GraphQL support, webhook management, and JSON/YAML manipulation tools.

Motivation

The existing tools handle web search and content extraction, but there is no structured API interaction capability. Office and marketing workflows frequently need to: call REST APIs (CRM, analytics, project management), query GraphQL endpoints, manage webhooks, and manipulate JSON/YAML data. Currently the agent must fall back to shell commands (curl, jq, yq) or rely on ad-hoc LLM reasoning, which is inconsistent and error-prone.

Proposed Solution

Create structured data and API tools:

• REST API Client: Make authenticated GET/POST/PUT/DELETE requests with configurable headers, body, and authentication (Bearer, Basic, API Key)
• GraphQL Client: Execute GraphQL queries and mutations with schema introspection
• Webhook Management: Create, list, and manage webhook endpoints with payload validation
• JSON Manipulation: Parse, transform, filter, and serialize JSON data with path-based access
• YAML Manipulation: Parse, transform, filter, and serialize YAML data with path-based access
• Data Transformation: Convert between JSON, YAML, CSV, and other formats with mapping rules

Each tool should follow the existing tool pattern in src/tools/ — a zod schema, an impl function, and registration in index.js with appropriate permissions (network:outbound for API calls, filesystem:read/write for data files).

Alternatives Considered

• Shell-based tools (curl, jq, yq): fragile, no structured output, requires user-installed dependencies.
• Rely on webExtract: only handles GET requests, no authentication or mutation capability.

OpenSpec Note

This project uses OpenSpec for feature development. If this request is approved, I will:

1. Run /opsx:propose to generate a full proposal with specs and tasks
2. Iterate on the design before any code is written
3. Follow the task-driven implementation workflow

Additional Context

This should integrate with the Google Workspace / Microsoft 365 gap (#783) — e.g., the REST API client could be used for API integrations that do not have dedicated tools yet. The existing webExtract tool handles GET requests; these tools would add full CRUD capability with authentication.