feat(api): add client bootstrap and service facade - #655

Add the synchronous BraintrustClient facade, AuthAPI organization discovery,
and logical app/API/proxy routing. Bootstrap now follows this flow:

    configured app URL
            |
            v
    POST /api/apikey/login
            |
            v
    select organization + apply URL overrides
            |
            v
    EndpointRouter(APP, API, PROXY)
            |
            v
    BraintrustClient resource services

New services share one policy-aware Transport and requests.Session, while
unmigrated logger call sites retain isolated HTTPConnection sessions:

    resource services -> Transport -> shared session
    legacy app_conn   -> HTTPConnection -> app session
    legacy api_conn   -> HTTPConnection -> API session
    legacy proxy_conn -> HTTPConnection -> proxy session

This keeps existing mutable adapter and retry behavior isolated until those
endpoints migrate. BraintrustState lazily initializes the facade under a lock,
then hydrates and authenticates all legacy connections from the same login.

The public entry point is now:

    client = BraintrustClient(api_key="...", org_name="my-org")
    url = client.router.resolve(RequestTarget.PROXY, "function/invoke")

Transport boundary in this commit:

- New Transport: the main SDK bootstrap request, POST /api/apikey/login on the
  app target, runs through AuthAPI with RetryMode.SAFE_READ.
- Service shells: projects, experiments, datasets, prompts, functions, queries,
  and attachments share the new Transport, but do not issue resource requests
  yet. Those endpoints migrate in follow-up changes.
- Legacy app HTTPConnection: project lookup/registration, experiment
  lookup/registration and base-experiment lookup, dataset registration,
  organization patching, and the CLI install login path.
- Legacy API HTTPConnection: ping/version discovery, logs3 ingestion and
  overflow setup, BTQL, v1 prompt/function/experiment/dataset reads,
  environment resolution, experiment and dataset summaries, attachments, and
  insert-functions writes.
- Legacy proxy HTTPConnection: function invocation, sandbox creation/listing,
  and code-bundle allocation.
- Signed object-storage uploads/downloads remain on separate token-less
  HTTPConnection instances and never use the routed Braintrust session.