feat: corporate actions from the Stockbit session (stocks actions, stocks calendar)

`idx stocks actions SYM [--kind ...]`: one stock's cash and stock
dividends, bonus shares, rights, warrants, splits and reverse splits,
meetings, public exposes and tender offers (`--kind ipo` adds its IPO),
newest first. `idx stocks calendar [--from] [--to] [--kind ...]`: the
market's actions dated in the range (default today and 30 days ahead),
oldest first. MCP: get_corporate_actions, get_corporate_calendar.

Stockbit's `/corpaction/{type}` serves one kind per request; each type has
its own field prefix and list key, so entitlements are read by field
suffix. An action's `date` is the cum date for entitlements, else the
event's first day. Dividends keep their decimals. One request per kind,
cached 6 hours. AUTHERROR without a session.

Fixtures are the 2026-11-03 recordings (market-wide ones trimmed to
October-December). Goldens added; help-stocks and completions-bash gain
the two subcommands, MCP tools.json the two tools (regenerated with
UPDATE_GOLDEN=1). The MCP docs counted 17 tools without stockbit_login;
now 20.

Claude-Session: https://claude.ai/code/session_01RqPPVeVDrnLoP7NUZmLRxY

ROADMAP.md

@@ -14,9 +14,10 @@ history lives in git.
 - Multi-period financial statements (today `financials` is single-period)
 - Order book depth without a login: no free source exists (IDX sells delayed
   depth to vendors); `stocks orderbook` needs the user's Stockbit login.
-- Corporate actions (`stocks actions`, `calendar`) and shareholder movements
-  (`ownership movements`) from the Stockbit session; design and endpoints in
-  `docs/STOCKBIT.md`.
+- Shareholder movements (`ownership movements`) from the Stockbit session;
+  design and endpoints in `docs/STOCKBIT.md`. Corporate-action follow-ups:
+  ex-dates of splits, bonuses and rights noted in `stocks history`, and the
+  `stock_dividend` / `reversesplit` row shapes once Stockbit lists one.
 - Stockbit login follow-ups: hourly OHLCV from the session's `1w` chart (the
   `1d` chart is per-minute closes only); confirming session 1 is
   `STATE_NAME_SESSION_1` (session 2, `BREAK` and `MARKET_CLOSED` were