fix(budget): flatten limit commands to 2-token leaves (limit-list/limit-set)

The CLI dispatcher (cli.py _build_parser) and completion generator both
partition the command name on the first space, nesting only two levels
(group + leaf). A three-token 'budget limit set' registers but is
unreachable via the CLI (invalid choice: 'limit'); the mocked unit suite
missed this because it calls handlers directly, bypassing dispatch.

Flatten to 'budget limit-list' / 'budget limit-set' (hyphenated 2-token
leaf), matching every other command. Logged the n-level dispatcher
refactor in TODO.md for when a future group needs real sub-subcommands.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

1 files changed, 10 insertions, 0 deletions

diff --git a/TODO.md b/TODO.md
index fdbb4bc..43f4d6a 100644
--- a/TODO.md
+++ b/TODO.md
@@ -24,6 +24,16 @@ bash completion).
 - [ ] Consider a `--no-color` flag (color is currently TTY-auto only).
 
 ## Infrastructure
+- [ ] n-level command nesting. `cli.py` `_build_parser` and
+      `scripts/gen_completion.py` both `partition(" ")` on the command name, so
+      they only nest two levels (group + leaf). `budget limit-set` /
+      `budget limit-list` are flattened to a hyphenated 2-token leaf as a
+      workaround (v0.4.0). Refactor both to split the full name into tokens and
+      build/scan nested subparsers per token, then a genuine `budget limit set`
+      (three tokens) works and future groups needing sub-subcommands are a
+      non-issue. Add a CLI-dispatch test (parse_args on the real parser), since
+      the mocked unit suite calls handlers directly and cannot catch a
+      dispatch/nesting break.
 - [ ] `--raw` escape hatch for arbitrary API calls.
 - [ ] OAuth as an alternative to personal access tokens.
 - [ ] zsh / fish completion (bash done).