[yashiels]

• Request bodies decoded from the 4.3.0 app DTOs and filled into every wishlist catalogue sample (real ids, no {}); documented in docs/MOBILE-API.md.
• Typed commands: wishlist add <groupId> --sku N|--plid P (legacy wishlist add group <id> --file still works; --file alone keeps last_used), wishlist move --from G --to G --tsin T, wishlist rm-items <groupId> --tsin T. All behind the dry-run/--confirm gate.
• Ids validated before any request (positive integers, SKU/TSIN/PLID >= 4 digits, resolved PLID sku included, --from != --to). Typed add requires an explicit group so it can never land in an unseen last_used list.
• wishlist move returns 400 for every payload; per-tsin move endpoint missing from catalogue #40: the per-TSIN move endpoint exists only in the web bundle, not the app; catalogued as excluded with that reason. wishlist move uses the app's items/move endpoint.

375 tests. Live round trip (scratch list create/add/move/back/remove/delete) restored all three lists. Oracle signed off (3 rounds).

Closes #37
Closes #40

[sentinel-skyner]

🛡️ Sentinel review

No material issues found in reviewed diff.

_{Automated review via cursorbridge:gpt-5.3-codex. Findings only — not an approval. Push new commits to re-review.}