breaking(portfolio): upgrade wallet_holdings to critical auth

Align CLI with server-side breaking change: GET /v1/user/wallet_holdings
was upgraded from authExistMW to authCriticalMW on the openapi-service.

- OpenApiClient: switch getWalletHoldings to authSignedRequest
- SKILL.md: split rate-limit table by auth level; update Notes section
- CLAUDE.md: move portfolio holdings from Normal to Critical auth row

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/client/OpenApiClient.ts

@@ -241,18 +241,18 @@ export class OpenApiClient {
     return this.authExistRequest("GET", "/v1/market/token_kline", query);
   }
 
-  // ---- Portfolio endpoints (exist auth) ----
+  // ---- Portfolio endpoints ----
 
   async getWalletHoldings(
     chain: string,
     walletAddress: string,
     extra: Record<string, string | number> = {}
   ): Promise<unknown> {
-    return this.authExistRequest("GET", "/v1/user/wallet_holdings", {
+    return this.authSignedRequest("GET", "/v1/user/wallet_holdings", {
       chain,
       wallet_address: walletAddress,
       ...extra,
-    });
+    }, null);
   }
 
   async getWalletActivity(
@@ -419,7 +419,7 @@ export class OpenApiClient {
     body: unknown
   ): Promise<unknown> {
     if (!this.privateKeyPem) {
-      throw new Error("GMGN_PRIVATE_KEY is required for critical-auth commands (swap, order, and follow-wallet commands)");
+      throw new Error("GMGN_PRIVATE_KEY is required for critical-auth commands (swap, order, follow-wallet, and portfolio holdings commands)");
     }
 
     return this.executePreparedRequest(() => {