feat: async SunbeamClient factory with unified auth resolution

SunbeamClient accessors are now async and resolve auth per-client:
- SSO bearer (get_token) for admin APIs, Matrix, La Suite, OpenSearch
- Gitea PAT (get_gitea_token) for VCS
- None for Prometheus, Loki, S3, LiveKit

Fixes client URLs to match deployed routes: hydra→hydra.{domain},
matrix→messages.{domain}, grafana→metrics.{domain},
prometheus→systemmetrics.{domain}, loki→systemlogs.{domain}.

Removes all ad-hoc token helpers from CLI modules (matrix_with_token,
os_client, people_client, etc). Every dispatch just calls
client.service().await?.

sunbeam-sdk/src/media/cli.rs

@@ -177,7 +177,7 @@ async fn dispatch_room(
     client: &SunbeamClient,
     fmt: OutputFormat,
 ) -> Result<()> {
-    let lk = client.livekit();
+    let lk = client.livekit().await?;
     match action {
         RoomAction::List => {
             let resp = lk.list_rooms().await?;
@@ -227,7 +227,7 @@ async fn dispatch_participant(
     client: &SunbeamClient,
     fmt: OutputFormat,
 ) -> Result<()> {
-    let lk = client.livekit();
+    let lk = client.livekit().await?;
     match action {
         ParticipantAction::List { room } => {
             let resp = lk
@@ -278,7 +278,7 @@ async fn dispatch_egress(
     client: &SunbeamClient,
     fmt: OutputFormat,
 ) -> Result<()> {
-    let lk = client.livekit();
+    let lk = client.livekit().await?;
     match action {
         EgressAction::List { room } => {
             let resp = lk