feat(cli+skill): make documented field UX real + fix skill doc drift

CLI (packages/inkreach-cli):
- new src/lib/field-normalize.ts: type aliases (sel/num/text/mul/…),
  select string-choices -> {name}, compact --fields 'Name:type:choices'
  expansion, smart type inference from --options shape / --name
  (--type now optional), name->ID resolution for foreignTableName /
  linkFieldName / lookupFieldName (incl. link-field foreignTableId
  backfill + unknown-key stripping), rating/number/button required-
  option defaults
- field create: +--description/--lookup-options/--is-lookup
- field update --options + table create --fields route through the
  normalizer; DEFAULT_ENDPOINT :3000 -> :3003
- 20 unit tests (field-normalize.spec.ts, vitest); live-verified:
  string choices, alias, foreignTableName, lookup-by-names, compact
  format, inference (priority->singleSelect, max:5->rating)

Skill docs (.agents/skills/inkreach-teable):
- ports :3000 -> :3003 everywhere (backend real port; :3000 is an
  unrelated container on this host)
- remove dead hr_admin account; note throwaway signup + real admin
- plugin register: actual URL-based flags; document plugin csp
  list/set; view/dashboard install requires config enable first
- field-types.md marked verified-2026-08 (aliases/inference/name
  resolution now implemented + tested)
- development.md: webpack dist/index.js cache trap; PGPASSWORD
  placeholder instead of wrong literal

.agents/skills/inkreach-teable/guides/cli-reference.md

@@ -6,7 +6,7 @@ Complete command reference for `inkreach-teable`. Global options apply to all co
 
 | Option | Description |
 |--------|-------------|
-| `--endpoint <url>` | Backend URL (default `http://localhost:3000`) |
+| `--endpoint <url>` | Backend URL (default `http://localhost:3003`) |
 | `--token <pat>` | Personal Access Token |
 | `--base-id <id>` | Default base id |
 | `--json` | Output raw JSON (for agent parsing) |
@@ -46,7 +46,9 @@ inkreach-teable table delete <tableId>
 # field  (get/update/delete take <tableId> <fieldId> — 2026-08 fix; old /api/field/:id routes never existed)
 inkreach-teable field list <tableId>
 inkreach-teable field get <tableId> <fieldId>
-inkreach-teable field create --table-id <tid> --name <n> --type <t> [--options '<json>']
+inkreach-teable field create --table-id <tid> --name <n> [--type <t|alias>] [--options '<json>'] \
+  [--description <d>] [--lookup-options '<json>'] [--is-lookup]
+#   --type optional: inferred from --options shape / --name when omitted
 inkreach-teable field update <tableId> <fieldId> [--name <n>] [--options '<json>']   # --options goes via convert API
 inkreach-teable field visible-choices <tableId> <recordId> <fieldId>                 # evaluate select-choice visibilityFilter
 inkreach-teable field delete <tableId> <fieldId>
@@ -174,8 +176,11 @@ Manage plugins and developer whitelist.
 # List plugins registered in the base
 inkreach-teable plugin list
 
-# Register a plugin (set runtimeType, positions, logo)
-inkreach-teable plugin register --name <name> --positions '["base","panel"]'
+# Register a URL-served plugin (runtimeType=url; status published immediately)
+# positions: "base"|"panel"|"view"|"dashboard"|"contextMenu"
+inkreach-teable plugin register --url <url> --name <name> [--positions '["panel"]'] [--logo <url>] [--description <d>]
+# Bundle (upload) plugins use a different flow — see skill guides/tables-fields.md
+# or api docs: create kebab-id plugin (developer whitelist) → upload → admin publish.
 
 # Developer whitelist (admin only)
 inkreach-teable plugin dev list
@@ -184,12 +189,19 @@ inkreach-teable plugin dev revoke <userIdOrEmail>  # remove
 
 # Install / uninstall (creates a base-level mount node)
 inkreach-teable plugin install --plugin <pluginId> --name "My Plugin" --position base
+#   ⚠️ For view/dashboard-position plugins, run `plugin config enable` BEFORE
+#   install, or the install API returns 403 RESTRICTED_RESOURCE
+#   'Plugin is not enabled for this base'.
 inkreach-teable plugin installs        # list installs in current base
 inkreach-teable plugin uninstall --install <installId>
 
 # Enable/disable plugins
 inkreach-teable plugin config enable --plugin <pluginId>
 inkreach-teable plugin config disable --plugin <pluginId>
+
+# CSP apiOrigins (external origins plugins may fetch)
+inkreach-teable plugin csp list
+inkreach-teable plugin csp set <pluginId> --origins '["http://192.168.x.x:8001"]'
 ```
 
 Developer whitelist is admin-only (requires `user.isAdmin=true`). Routes: