docs: true-up README and root description with current capabilities

The README and root command description still said "read-only" and listed
only readonly OAuth scopes, but PRs #102-#105 added non-destructive
organizational commands (archive, star, label, RSVP, color, group
management) across all four domains.

- Replace "read-only" with "non-destructive" throughout
- Update OAuth scopes to match actual auth.AllScopes
- Add all 16 missing organizational commands to usage examples and
  command reference
- Add Bulk Operations section documenting --ids/--stdin/--query/--dry-run
- Add --ids flag to search/list command references
- Reword Security section to accurately describe permitted operations
- Update root command Short and Long descriptions

Author: rianjs