feat: campus client update needs --redirect-uri (repeatable) for campus#651 readiness #14

Description

campus client update only accepts --name/--description. There is no --redirect-uri flag, although campus client new has one (added in PR #12) and the underlying API accepts redirect_uris on PATCH /clients/{id}/.

This blocks the redirect_uri registration runbook that apps must complete before campus#651 (exact-string redirect_uri enforcement on GET /authorize) flips:

campus client update --client-id <CLIENT_ID> \
  --redirect-uri https://<domain>/finalize_login \
  --redirect-uri http://localhost:5000/finalize_login

Verified missing at campus-cli HEAD e33daac (2026-09-30).

Use Case

Consumer apps (e.g. campus-classroom) must register exact callback URIs on their campus client before enforcement. Registration is CLI-driven; today the only paths are campus client new with the flag (creates a new client) or hand-rolled API calls.

Proposed Solution

Add repeatable --redirect-uri to client update, passing redirect_uris=list(...) through to auth_clients[id].update(...). Note the API semantics: the PATCH replaces the whole list, so the docs/help should say "pass the full set; existing URIs are replaced".

Note: once nyjc-computing/campus-api-python#49 (update() PUT vs PATCH) is fixed, this flag will actually work end-to-end; today even a CLI implementation would fail on the PUT.

Alternatives Considered

Workaround used meanwhile: call the API directly (PATCH /auth/v1/clients/{id} with {"redirect_uris": [...]}) using a device-flow token.