barista: generic resource verbs with validation and dry run in the API, and settle barako vs barista as the CLI name

The CLI plan in #801 is one command per barakoBrew screen: `barako site theme set` repeats the shape checks barakoBrew's Theme screen makes (BaryoDev/barakoBrew#134), and every write promises `--dry-run`. The API has a server dry run for only a few things: workflows (`barakoCMS/Features/Workflows/DryRunWorkflow/Endpoint.cs:59`), requests (`barakoCMS/Features/Requests/Endpoints.cs:332`) and redirect import (`barakoCMS/Features/Redirects/ImportEndpoint.cs:15`). Everywhere else the CLI would have to guess, or reimplement validation that barakoBrew already has. The CLI also has two names: `barako` in #801 and #345, `barista` in #843, #844 and #851.

### Why it is too specific

A command per screen means every new module (a clinic's booking, a school's attendance) needs hand-written commands in the CLI, its checks copied a third time, and its dry run faked on the client. barakoBrew, the MCP server (#582) and the VS Code extension (#843) would each need the same copies.

### The general concept

Generic resource verbs (`get`, `list`, `create`, `update`, `delete`, and `apply` from #345) over the generated client slices (#182, #183), so a module's resources appear in the CLI when its slice does. Validation and dry run live in the API: every write endpoint accepts an optional dry run that runs the validators and returns what would change, without saving. barakoBrew, the CLI, MCP and VS Code all call the same thing. And one name for the CLI, settled before a tool is published.

### Where it lives

Core: dry run on write endpoints. CLI: the verbs on the generated slices.

### Compatibility

A dry run flag is an optional request field, which is not a breaking change to the HTTP surface. The CLI is not published under either name yet, so settling the name now costs an edit to the plans. If a name has been used in docs, the other ships as an alias command for one major. #801, #345 and #851 are amended once this is decided.

### Done when

- The CLI name is decided and written on this issue.
- Content type and entry writes accept a dry run that returns the validation result and the diff without saving, with a test that nothing is stored.
- One resource from a module slice is reachable through the generic verbs with no command written for it.

Found in the too specific sweep of 15 September 2026.

Start by reading the existing dry-run implementations in Features/Workflows/DryRunWorkflow/Endpoint.cs, Features/Requests/Endpoints.cs, and Features/Redirects/ImportEndpoint.cs, then inspect the generated client slices. Settle the CLI name, add dry-run coverage for content type and entry writes that verifies nothing is stored, and expose one slice resource through the generic verbs.

Written by the indexing model from the issue text.