Expose box designations and whole-box seen in the CLI

Hi — thanks for the CLI, it's become the backbone of an automated triage workflow I run against my personal HEY account. Two operations exist in `hey-sdk/go` v0.4.0 but aren't reachable from the CLI, so scripts have to fall back to raw HTTP with `hey auth token`. Both are HEY-native concepts rather than new machinery.

### 1. Box designations

`hey-sdk` has `CreateBoxDesignation` and `DeleteBoxDesignation`:

```
POST /boxes/{boxId}/designations.json {"contact_id": N}
DELETE /boxes/{boxId}/designations/{designationId}
```

I want to be careful about how I frame this, because HEY deliberately doesn't do filters and rules, and I'm not asking for those. A designation is the routing decision HEY already models — this contact's mail belongs in this box — the same call the app makes when a sender is placed in the Imbox, The Feed or Paper Trail. I'm only asking to reach it from the CLI.

The practical gap: `hey move` handles threads that already arrived, but nothing in the CLI affects where the *next* one lands, so tidying a box never converges. You move the same sender's mail out week after week. `hey contacts update` only covers name/email/aliases.

```bash
hey designate --to feed
hey designate --remove
hey designations list # if a GET endpoint exists or could be added
```

The read side matters most for scripting — I couldn't find any way to enumerate existing designations, which makes changes impossible to apply idempotently.

### 2. Mark a whole box seen

`hey-sdk` has `MarkBoxSeen`:

```
POST /boxes/{boxId}/observation.json
```

My Paper Trail had ~1000 unread — it's an archive I search rather than read. Clearing it through `hey seen` means 20 batched calls with explicit posting ids; the API does it in one request, and the app already offers the equivalent action.

```bash
hey seen --box "paper trail"
```

One note in case it saves someone time: `POST /boxes/{id}/observation.json` returns 403 when the request carries Python's default `User-Agent: Python-urllib/3.x`. Setting any explicit User-Agent makes it return 201. That tripped me up for a while, since the failure looks like a permissions problem.

Both against `0337cb5` and `hey-sdk/go` v0.4.0. Happy to test.