Distinguish HEY World posts from email - #185

What changed

HEY box responses can mix email topics with published HEY World posts. The CLI treated every item as an email, which made counts misleading and made email actions look valid for published content.

This change:

• preserves each item kind in CLI and TUI models
• reports total items, email count, and HEY World post count in JSON metadata
• summarizes mixed boxes as, for example, 2,944 emails and 21 HEY World posts
• adds --kind to email organization commands and rejects world/post before authentication or any HTTP request
• blocks thread opening, moving, Trash, Spam, and ignore actions for World posts in the TUI
• adds a separate hey world delete <token> --confirm command using the SDK World endpoint

Existing command calls without --kind remain compatible. Callers that read from hey box --json should pass the returned kind so the CLI can enforce the boundary. The TUI already has that context and enforces it automatically.

World deletion requires the post token, not the box item ID, and explicit confirmation. No existing HEY World posts were deleted while developing or testing this change.

Tests

• make check
• mixed email and World post counts and JSON metadata
• all seven email-only CLI actions reject world/post without making a request
• TUI email actions reject World posts without making a request
• World deletion requires confirmation and uses /world/posts/{token}, never /postings/trash

Summary by cubic

Distinguishes HEY World posts from email, separates box item IDs from email topic IDs, and blocks email actions on published content. Previously every box item was treated as email and IDs were conflated; now the CLI/TUI preserve kind, show accurate counts, and route HEY World deletions through a dedicated command.

• hey box preserves per-item kind, shows Item/Kind/Topic columns (World posts have no Topic), prints mixed summaries (e.g., “2,944 emails and 21 HEY World posts”), and adds JSON metadata: posting_count, email_count, world_post_count.
• Email actions (seen, unseen, move, trash, spam, ignore, stop-ignoring) accept --kind, act on box id (not topic_id), and reject world/post locally before auth or any request.
• TUI blocks open/move/trash/spam/ignore on world/post, shows a notice, and makes no requests.
• Adds hey world delete <token> --confirm using /world/posts/{token} (separate from email Trash); help includes a new HEY WORLD section and updates email action examples to include --kind topic.

Migration

• Existing calls remain compatible without --kind. If you parse hey box --json, pass id + --kind topic for email actions and use topic_id for reading/replying/forwarding; do not assume id == topic_id.
• Email actions on world/post now fail locally with guidance and make no requests.
• To remove a HEY World post, use hey world delete <token> --confirm with the post token (not the box item ID).

^{Written for commit 934ce67. Summary will update on new commits.}