feat: async SunbeamClient factory with unified auth resolution

SunbeamClient accessors are now async and resolve auth per-client:
- SSO bearer (get_token) for admin APIs, Matrix, La Suite, OpenSearch
- Gitea PAT (get_gitea_token) for VCS
- None for Prometheus, Loki, S3, LiveKit

Fixes client URLs to match deployed routes: hydra→hydra.{domain},
matrix→messages.{domain}, grafana→metrics.{domain},
prometheus→systemmetrics.{domain}, loki→systemlogs.{domain}.

Removes all ad-hoc token helpers from CLI modules (matrix_with_token,
os_client, people_client, etc). Every dispatch just calls
client.service().await?.

sunbeam-sdk/src/gitea/cli.rs

@@ -2,9 +2,9 @@
 
 use clap::Subcommand;
 
+use crate::client::SunbeamClient;
 use crate::error::{Result, SunbeamError};
 use crate::gitea::types::*;
-use crate::gitea::GiteaClient;
 use crate::output::{render, render_list, read_json_input, OutputFormat};
 
 // ---------------------------------------------------------------------------
@@ -435,7 +435,8 @@ fn notification_row(n: &Notification) -> Vec<String> {
 // Dispatch
 // ---------------------------------------------------------------------------
 
-pub async fn dispatch(cmd: VcsCommand, client: &GiteaClient, fmt: OutputFormat) -> Result<()> {
+pub async fn dispatch(cmd: VcsCommand, client: &SunbeamClient, fmt: OutputFormat) -> Result<()> {
+    let client = client.gitea().await?;
     match cmd {
         // -- Repo -----------------------------------------------------------
         VcsCommand::Repo { action } => match action {