sklik rozsireni na typove metody

documentation/overview.md

@@ -36,9 +36,11 @@ app/
   logging_config.py    get_logger(); secrets are never logged
   errors.py            MissingCredentialsError, UpstreamError + handlers
   credentials.py       X- header dependencies (GA / GSC / Ads / Sklik)
+  idempotency.py       in-memory idempotency store for writes (opt-in per request)
+  sklik_guards.py      write guard rails: forced paused status, optional budget caps
   clients/
     google.py          shared Google client: Bearer/SA token minting + requests
-    sklik_client.py    Sklik JSON-RPC client (login + session + report paging)
+    sklik_client.py    Sklik JSON-RPC client (login + session + list/report paging)
   routers/
     meta.py            /health, /version
     ga_data.py         /ga/data/...      (Google Analytics Data)
@@ -64,6 +66,23 @@ routes are unprefixed (Caddy `handle_path` strips the prefix).
 | Google Ads | `X-GAds-Developer-Token` (req) + `X-GAds-Access-Token` **or** `X-GAds-Credentials` (+ `X-GAds-Login-Customer-Id`, `X-GAds-Quota-Project`) | Same OAuth (scope `adwords`) plus `developer-token` / `login-customer-id` headers forwarded upstream. |
 | Sklik | `X-Sklik-Token` (+ `X-Sklik-User-Id`) | `client.loginByToken` per request → session injected into the call. |
 
+## Writes
+
+**Sklik is the only upstream with write endpoints** — full CRUD over campaigns,
+groups and ads (create / update / remove / restore). The pattern established
+there — create paused, optional budget ceilings, optional idempotency key — is
+the template for any future write support (Google Ads mutates, Meta campaign
+management in the sibling `meta` service).
+
+The one non-negotiable rule: **entities are always created paused**. Sklik
+defaults `status` to `active`, so this must be forced server-side. Update does
+*not* force a status (that is how you pause or resume a campaign), but an
+operator can refuse activation entirely with `SKLIK_BLOCK_ACTIVATION`. Budget
+ceilings and idempotency are opt-in, since the approval flow lives on the
+caller's side. Removal is Sklik's own soft delete and is reversible.
+
+See `sklik.md` for details.
+
 ## Deliberately not wired
 
 - **Write operations** across the Google services: GA Admin (create/update
@@ -71,6 +90,9 @@ routes are unprefixed (Caddy `handle_path` strips the prefix).
   sites), Google Ads mutates (create/update campaigns etc.). All requested
   scopes are read-only; add the read-write scope + endpoints if management is
   needed later. Google Ads exposes reporting (GAQL) only for now.
+- **Sklik keyword / sitelink / product-set management.** Only campaigns, groups
+  and ads have typed CRUD; the rest of the Sklik API remains reachable through
+  `POST /sklik/rpc/{method}` without guard rails.
 - **Sklik header-credential encryption.** Same deferral as `idoklad`/`csob`:
   header values are plaintext over TLS for now.
 - **Sklik session reuse across requests** — the chosen model logs in per