…download_dewey_duck

Preview path no longer paginates the full file manifest — hits page 1 of
/v1/external/data/<id>/files directly via deweypy.api_request, unblocking
preview_dewey_duck() on Visits-scale datasets where the manifest hang made
it unusable. download_dewey_duck() now accepts partition_key_after and
partition_key_before, threaded through to deweypy.get_dataset_files() so
the manifest is server-side filtered before download — the missing piece
researchers needed to pull a date-bounded slice on storage-limited setups.

Hardens the R/Python boundary: structured JSON errors on stderr with
non-zero exit, R surfaces them as stop() with the original message;
empty-stdout treated as failure (covers system2 corner cases like uv
crash before output); collision-proof __DEWEYR_NULL__ sentinel replaces
"None" so user values like literal "None" round-trip safely; cols
fallback now peeks the filtered URL set instead of an unfiltered preview.

Adds 25 testthat tests (32 total, 0 failures) covering argv contract,
partition_key validator gates, forwarding via local_mocked_bindings,
and sentinel-collision regression.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

system2() silently drops empty-string elements from args, which shifts
every positional argv on the Python side. With Sys.getenv("DEWEY_API_KEY")
returning "" (e.g. an R session that didn't load .Renviron), this caused
data_id to be read as the sentinel string and produced a confusing 401
on data/__DEWEYR_NULL__/files instead of a clear "set your API key"
message. Reject empty / NA / non-character api_key and data_id at the
gate, with an actionable hint pointing to readRenviron().

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>