feat(report): support delegated sender submission

[pangpangDaddy]

Summary

• add --sender-user-id to report submission commands
• preserve the existing MCP report.create_report route when sender is omitted
• route delegated submissions through DingTalk OAPI /topapi/report/create with create_report_param.userid
• require caller-owned AppKey/AppSecret and employee report management permission
• add dry-run, tests, docs, changelog, and design spec

Closes #406

Verification

• go test ./internal/helpers ./internal/app ./internal/apiclient ./internal/auth -count=1
• go test ./internal/... ./pkg/... -count=1
• go vet ./internal/helpers ./internal/app
• go build -o /tmp/dws-issue406 ./cmd
• ./scripts/policy/check-command-surface.sh --strict
• ./scripts/policy/check-generated-drift.sh
• ./scripts/policy/check-open-source-assets.sh
• git diff --check

Full go test ./... -count=1 still fails in existing unrelated suites because test/cli_compat/testdata/empty_catalog.json is missing, package-script fixtures are not valid tar archives in this environment, and the existing open-source policy test flags internal/app/upgrade_embedded_guard_test.go.