feat: add rdt post — create post drafts and (captcha-gated) publish

[nikicat]

Summary

Adds rdt post — create Reddit posts from the CLI via the web GraphQL API (svc/shreddit/graphql), reusing the existing cookie session. No new runtime dependencies.

• Drafts (text/link) are created fully headlessly: rdt post <sub> <title> --text "..." --draft.
• Publishing (subreddit CreatePost / profile CreateProfilePost, including images) is gated behind reCAPTCHA Enterprise, so it requires a browser-supplied --recaptcha-token (single-use, ~2 min). The tool never solves the captcha itself.
• Image drafts are rejected with a clear message — Reddit's draft input type has no media field, so drafts can't store images.

Why the TLS change

httpx/httpcore ship a restricted cipher list whose TLS ClientHello is rejected by Reddit's WAF on POST /svc/shreddit/graphql (403 "blocked by network security") — reads and the legacy /api/* endpoints are unaffected. Resetting to ssl.create_default_context() + set_ciphers("DEFAULT") (in transports.build_ssl_context(), applied via verify=) produces a fingerprint the WAF accepts (stock curl passes the same way). Pure-Python, not browser impersonation, no new deps.

Command

rdt post <sub|u_name> <title> (--text | --url | --image) \
         [--draft] [--recaptcha-token TOK] [--nsfw] [--spoiler] [--json | --yaml]

--draft saves headlessly; without it, --recaptcha-token is required; --image --draft is rejected.

Implementation

• transports.py — TLS SSL-context fix + application/json writes.
• session.py — ensure_csrf_token() (double-submit CSRF; cookie == body).
• client.py — _graphql, resolve_subreddit_id, create_media_lease, upload_image (S3 multipart), create_post, create_draft.
• commands/submit.py — the post command.
• constants.py, cli.py, tests, README/SKILL.

Testing

• 141 unit tests pass (pytest, mocked — no network), ruff clean, mypy adds no new errors.
• Text-draft path verified live end-to-end against Reddit.

🤖 Generated with Claude Code