feat(snapshots): Add download command for baseline snapshots

[NicoHinderling]

Summary

• Adds sentry-cli snapshots download command for downloading baseline snapshot images from Sentry's preprod system to a local directory
• Supports --app-id (resolves latest baseline snapshot) or --snapshot-id (direct artifact ID), with optional --branch filter
• Downloads a ZIP from the server and extracts images to --output directory (default ./snapshots-base/)
• Adds two API methods: get_latest_base_snapshot and download_snapshot_zip

Usage

# Download latest baselines for an app
sentry-cli snapshots download --app-id sentry-frontend -o ./snapshots-base/

# Download from a specific branch
sentry-cli snapshots download --app-id sentry-frontend --branch main -o ./snapshots-base/

# Download a specific snapshot by ID
sentry-cli snapshots download --snapshot-id 259299 -o ./snapshots-base/

# Full local visual regression workflow
sentry-cli snapshots download --app-id sentry-frontend -o ./snapshots-base/
pnpm run snapshots
sentry-cli snapshots diff ./snapshots-base .artifacts/snapshots --fail-on-diff

Test plan

• cargo clippy -- -Dwarnings passes clean
• cargo fmt --check passes
• cargo test snapshots — all 4 integration tests pass (including new download help test)
• Manual test: run sentry-cli snapshots download --app-id sentry-frontend against real Sentry org

🤖 Generated with Claude Code

[github-actions]

	Messages
📖	Do not forget to update Sentry-docs with your feature once the pull request gets approved.

Generated by 🚫 dangerJS against a218cba

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 8783c35. Configure here.}

[cameroncooke]

sentry-cli snapshots download returns 404 when using an org auth token

The snapshots download command fails with No baseline snapshot found even when a base snapshot clearly exists in the UI.

Root cause: The endpoint GET /api/0/organizations/{org}/preprodartifacts/snapshots/latest-base/ calls get_filter_params(), which — when no project= query param is supplied — falls back to "projects the caller is a member of." Org auth tokens (sntrys_*) aren't associated with a user, so they have no project membership, and the call short-circuits to NoProjects → 404. The user never sees a distinct error; it looks identical to "snapshot doesn't exist."

Confirmed: Adding &project=<id> to the same request returns the snapshot successfully — org tokens satisfy has_project_access via their scopes, just not the membership path.

Fix options:

1. CLI side: Add a --project flag to sentry-cli snapshots download and forward it as project=<id>. Matches
   the convention used by build upload and other commands. Smallest change, works in CI.
2. Server side: When no project= is supplied, fall back to scoping by organization_id only (the endpoint already orders by -date_added and filters by app_id). Risk: app_id collisions across projects within an org become possible.

[cameroncooke]

Just wondering if we can add support to include JSON sidecar files too?