feat: SDK auth/client config factories (bearerToken, browserSession, createSentryClient)

[betegon]

Configuring a Sentry deployment and credentials currently requires repeating options across calls. Export the generated client and add bearerToken(...) and browserSession(...) so consumers can configure requests once. Servers can create an isolated createSentryClient(...) per deployment and authentication context.

Before and after

Here, token and baseUrl come from the consumer's deployment configuration.

Before: pass deployment and authentication options to each operation.

import { listOrganizations, getOrganization } from "@sentry/api";

const organizations = await listOrganizations({
  baseUrl,
  headers: { Authorization: `Bearer ${token}` },
});
const organization = await getOrganization({
  baseUrl,
  headers: { Authorization: `Bearer ${token}` },
  path: { organization_id_or_slug: "example-org" },
});

After: configure an isolated client once and reuse it across operations.

import {
  bearerToken,
  createSentryClient,
  listOrganizations,
  getOrganization,
} from "@sentry/api";

const sentry = createSentryClient(bearerToken({ token, baseUrl }));

const organizations = await listOrganizations({ client: sentry });
const organization = await getOrganization({
  client: sentry,
  path: { organization_id_or_slug: "example-org" },
});

Each instance belongs to one deployment and authentication context. For a single-context application, the exported singleton also supports client.setConfig(bearerToken({ token, baseUrl })), followed by calls without a client option. Result and error handling are unchanged.

Explicit Enterprise, self-hosted, custom, and regional origins are preserved without discovery or extra requests. Existing custom fetch implementations and per-call overrides still compose with the client. The browser factory reuses the existing cookie/CSRF helper. Generated fetch configuration accepts portable callable implementations under both Bun and Node, without requiring runtime-specific properties such as fetch.preconnect.

The README covers the public entry points, and the client design records region/cache ownership, control versus regional operations, canonical web links, and consumer responsibilities. This foundation can support a bounded MCP adoption with raw adapters for endpoints outside the public schema; it does not need to wait for the routing and progressive-accuracy helpers in #79 and #80. Region discovery/cache, link builders, retries, and identity endpoint publication remain separate work.

Validation: bun run build, bun run typecheck (Bun/DOM and Node-only declarations), bun test (115 passing), and npm pack. Public-package contract tests cover exact request origins, credential isolation, overrides, custom transport, error policy, generic requests, and browser authentication. A Node smoke test against the unpacked tarball verified imports and singleton request configuration without validator dependencies. No live Sentry deployment or real browser was exercised.

Part of #81.