fix(cli): recognize account ls alias for agent role; align account show output; document edit password invariant

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

internal/cli/run.go

@@ -32,7 +32,8 @@ func commandRole(args []string) store.Role {
 	case "account":
 		// account list is a read-only discovery view available to agents;
 		// add/edit/remove mutate config and require admin.
-		if len(args) >= 2 && args[1] == "list" {
+		// Normalize the verb so `account ls` routes the same as `account list`.
+		if len(args) >= 2 && normalizeVerb(args[1]) == "list" {
 			return store.RoleAgent
 		}
 		return store.RoleAdmin