Three fresh-eyes findings:
- Remove the "Subscriptions cannot use On Extract Refresh" entry. The
  REST API's refreshExtractTriggered attribute does support this, and
  TSC support is landing in #1861 (which closes the tracker #1658). The
  entry is about to be factually wrong on both counts.
- Soften the intro: it promised "follow the appropriate issues" for
  every item, but the vf_-silently-dropped entry has no tracker filed.
  New wording says "where filed" so the doc doesn't overpromise.
- Reword the daily-schedules note to describe behavior neutrally
  ("currently runs daily schedules hourly instead") rather than calling
  it a "bug", which reads punchy on a public docs page.

* docs: add Known server-side limitations section

Add a new user-facing section to docs/api-ref.md that lists behaviors
users may hit that are constrained by the Tableau Server REST API
rather than by TSC. Each entry links its tracking issue and notes
where the fix is expected to land. Cross-link the new section from
the top-of-page note, and point at the `Server-Side Enhancement`
label as the live tracker maintained by this repo.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* docs: drop internal work-item IDs and per-bullet fix-scope tag

Public docs on gh-pages will be indexed, so remove the internal
work-item numbers (W-...) from the Known server-side limitations
section along with the paragraph that described what they were.
Also strip the redundant per-bullet "Fix expected: server-side"
tag: the section title already scopes the whole list to server-side
gaps.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Drop On Extract Refresh entry, soften intro and daily-schedule wording

Three fresh-eyes findings:
- Remove the "Subscriptions cannot use On Extract Refresh" entry. The
  REST API's refreshExtractTriggered attribute does support this, and
  TSC support is landing in #1861 (which closes the tracker #1658). The
  entry is about to be factually wrong on both counts.
- Soften the intro: it promised "follow the appropriate issues" for
  every item, but the vf_-silently-dropped entry has no tracker filed.
  New wording says "where filed" so the doc doesn't overpromise.
- Reword the daily-schedules note to describe behavior neutrally
  ("currently runs daily schedules hourly instead") rather than calling
  it a "bug", which reads punchy on a public docs page.

* Drop the vf_ exact-match limitation entry

Opus-5 review found the entry's tracker link (#1431) points at a
closed-not-planned issue; the underlying gap was filed with the
Tableau REST API docs team internally and there's no realistic
timeline for it being tracked back in the TSC repo. Rather than
carry an untracked entry indefinitely, drop it. The behavior claim
(vf_ is exact-match / OR-list only) is now covered by the expanded
docstring on RequestOptions.vf() in #1840.

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Round of fixes for the sample-scripts refactor after fresh-eyes review.

Blocker: publish_workbook.py reused `-u` for --thumbnails-user-id while
_shared.py add_common_arguments already binds `-u` to --username, so
argparse raised ArgumentError on module load and the script would not
start. Renamed to `-U`.

Real bugs:
- _shared.py .env search now checks cwd, samples/, and repo root (in that
  order) so the docstring stops lying about "next to the sample or cwd."
- resolve_credentials now gates input()/getpass on sys.stdin.isatty()
  as the docstring already promised, so piped/CI invocations no longer
  hang forever.
- manage_subscriptions.py --attach-image switched to
  argparse.BooleanOptionalAction so users can actually pass
  --no-attach-image; the previous store_true+default=True made the flag
  a permanent True.
- Header docstring in _shared.py no longer claims "no existing command
  line breaks" (which was false: -p migrated from --token-name to
  --password in an earlier commit). Documented the tabcmd-aligned short
  flags instead.
- Corrected Python-version headers on login.py, list_jobs.py,
  manage_subscriptions.py, publish_workbook.py, refresh_tasks.py,
  move_workbook_sites.py, publish_datasource.py, and
  update_workbook_data_freshness_policy.py -- repo floor is 3.10 per
  pyproject.toml.
- list_jobs._wait_for_job: reordered excepts so JobCancelledException
  (a subclass of JobFailedException) is caught first, otherwise
  cancelled jobs were reported as failed with the wrong exit code.
- login.py sign-in banner now branches on JWTAuth as well, so JWT
  logins no longer print "Username: None". Header env-var list updated
  to include TABLEAU_JWT / TABLEAU_JWT_FILE.

New JWT support: _shared.py add_common_arguments now exposes --jwt and
--jwt-file, resolves TABLEAU_JWT / TABLEAU_JWT_FILE from env, reads a
JWT file path into args.jwt during resolve_credentials, and returns
TSC.JWTAuth from build_auth when a JWT is present. JWT takes priority
over PAT and username/password.

Extract-refresh subscription: manage_subscriptions.py create now
accepts --on-extract-refresh, which calls
SubscriptionItem.on_extract_refresh() to construct a subscription that
fires when the referenced extract-refresh schedule completes (the flow
introduced in #1861). Rebased this branch onto
jac/subscription-refresh-extract-triggered so the flag lands on top of
the new API without conflicts.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>