feat: add consent signing keys, resource server type, and connection OTP settings - #905

Summary

Adds user consent signing key management, a resource server type, per-channel OTP settings on database connections, and oidc_support on client responses to the Management API client. Removes the CAPTCHA policies client.

Added

• User consent signing keys: admins can now see and manage the keys a user's devices registered for signing consent decisions. List a user's keys with client.users.list_consent_signing_keys(), fetch one with client.users.get_consent_signing_key(), and remove one, for example after a lost device, with client.users.delete_consent_signing_key().
• Resource server type: a resource server can now be marked as a Universal Commerce Protocol server by passing type to resource_servers.create() or resource_servers.update(). The type is returned whenever a resource server is read.
• OTP settings for database connections: database connections can now set the length of one-time passwords and how long they stay valid, separately for email and phone. Pass otp_settings in the connection options to connections.create() or connections.update().
• Client OIDC support on reads: a client's oidc_support setting, which could already be set on create and update, is now returned when clients are read, listed, searched, updated, or have their secret rotated.
• Smaller additions:
  • Segments can be filtered by status in segments.list().
  • SAML connections can be configured as a cross-app access requesting app, including the identity provider's client_id and client_secret in the connection options.
  • Event stream cloud events now carry the authorization transaction behind the event, such as the protocol, response type and mode, requested scopes, and redirect URI.

Changed

• Feature flag variations: variations.update() now documents how overrides are applied. Top-level keys merge into the stored overrides, a key set to None removes it, and passing None or {} clears all overrides.
• Tenant settings: the dashboard_insights_view flag is now marked as deprecated. It has no effect and remains only for backward compatibility.

Removed

• CAPTCHA policies: the captcha_policies client under attack protection, along with every model that backed it. That covers the policy, match, and action models, the active provider enum, the list response, and the per-provider action settings for Arkose, Friendly Captcha, hCaptcha, reCAPTCHA Enterprise, reCAPTCHA v2, Simple CAPTCHA, and the Auth Challenge.