feat: support for bucket-exposure table-aliases and listing (Analytics Hub) endpoints

[vojtechnovotny-heu]

What's missing

kbagent has no support for two Storage API endpoints we're using to expose Keboola
buckets to BigQuery Analytics Hub consumers:

1. POST /v2/storage/branch/{branchId}/buckets/{bucketId}/table-aliases
2. POST / GET / PATCH /v2/storage/branch/{branchId}/buckets/{bucketId}/listing
   (the exposure listing itself — bigquery.listingResourceName in the GET response
   is what a consumer subscribes to via Analytics Hub, out of scope here)

Right now we build request bodies by hand and hit these with raw curl + a
kbagent token create --bucket-write scoped token, since neither endpoint has a
client/service/command in the CLI (checked client/storage_tables.py — it has
create_bucket, share_bucket/link_bucket, but nothing for aliases or listings).

What we found by observation (not from public docs)

These endpoints don't appear to be documented anywhere we could find — not in
Keboola's public docs, not in this repo, not in kbagent serve's OpenAPI. We
captured the request/response shapes by intercepting window.fetch in the
Keboola UI's own bucket-exposure flow. Two things worth a maintainer's eyes:

• The PATCH (update) endpoint's description field is named exposureDescription,
  but POST (create) uses listingDescription — same resource, different field
  name depending on verb. We only confirmed this because we saw both in the wire
  capture; happy to share exact request/response bodies if useful.
• bigquery.listingId appears immutable once created (client-side form
  constraint, not confirmed server-side) — matches ^[a-zA-Z0-9_]+$, ≤63 chars.

Proposed shape (matching existing patterns)

• client/storage_tables.py: create_table_alias(bucket_id, source_table, name, branch_id=None),
  create_listing(...), get_listing(...) — same prefix/body pattern as create_bucket
• storage create-table-alias, storage create-listing, storage get-listing commands
• OPERATION_REGISTRY entries (write category)
• Given the endpoints are unpublished, we'd love a maintainer confirmation of the
  contract before anyone sinks time into a PR — happy to share our captured
  request/response samples if that helps.

Not requesting: an Analytics Hub subscribe client. That call runs on the
consumer's own GCP side with their own ADC credentials against Google's API, not
Keboola's — outside kbagent's surface regardless of this feature.

[vojtechnovotny-heu]

Follow-up from live-testing this against a real project: once get-listing exists, it needs to surface bigquery.listingResourceName in its output, not just bigquery.listingId.

Use case: subscribing a consumer BigQuery project to an exposure via the Analytics Hub :subscribe API requires the fully-qualified resource path (projects/{producerProjectNumber}/locations/eu/dataExchanges/{exchangeId}/listings/{listingId}), not the plain listing id. This is only ever handed back on the Storage API's GET .../listing response — nowhere else.

Why it's necessary — confirmed by testing every other avenue first:

• BigQuery Studio's own "Search listings" UI can resolve a listing by its plain id and subscribe with a couple of clicks, but that's a private, UI-only search — Analytics Hub's public discovery document has no equivalent search-by-listing-id method a script could call.
• Cloud Audit Logs on the consumer project don't help either — Data Access logging for Analytics Hub is off by default, so there's no way to recover the resource name after the fact from log history.
• Without get-listing exposing this field, the only way to script a subscribe is to reconstruct the exchange id by guessing (e.g. assuming it matches a sibling listing's already-known exchange in the same Keboola project) — fragile, and exactly the kind of thing a CLI should make unnecessary.

Same underlying blocker as #779 (canManageBuckets scope) — a get-listing command still needs a token at that tier to read this field at all, so the two issues are companions: #779 gets the token, this one needs the read to actually return the field once it's callable.