feat: async SunbeamClient factory with unified auth resolution

SunbeamClient accessors are now async and resolve auth per-client:
- SSO bearer (get_token) for admin APIs, Matrix, La Suite, OpenSearch
- Gitea PAT (get_gitea_token) for VCS
- None for Prometheus, Loki, S3, LiveKit

Fixes client URLs to match deployed routes: hydra→hydra.{domain},
matrix→messages.{domain}, grafana→metrics.{domain},
prometheus→systemmetrics.{domain}, loki→systemlogs.{domain}.

Removes all ad-hoc token helpers from CLI modules (matrix_with_token,
os_client, people_client, etc). Every dispatch just calls
client.service().await?.

sunbeam-sdk/src/auth/hydra/mod.rs

@@ -29,9 +29,9 @@ impl ServiceClient for HydraClient {
 }
 
 impl HydraClient {
-    /// Build a HydraClient from domain (e.g. `https://auth.{domain}`).
+    /// Build a HydraClient from domain (e.g. `https://hydra.{domain}`).
     pub fn connect(domain: &str) -> Self {
-        let base_url = format!("https://auth.{domain}");
+        let base_url = format!("https://hydra.{domain}");
         Self::from_parts(base_url, AuthMethod::None)
     }
 
@@ -467,7 +467,7 @@ mod tests {
     #[test]
     fn test_connect_url() {
         let c = HydraClient::connect("sunbeam.pt");
-        assert_eq!(c.base_url(), "https://auth.sunbeam.pt");
+        assert_eq!(c.base_url(), "https://hydra.sunbeam.pt");
         assert_eq!(c.service_name(), "hydra");
     }