feat: async SunbeamClient factory with unified auth resolution

SunbeamClient accessors are now async and resolve auth per-client:
- SSO bearer (get_token) for admin APIs, Matrix, La Suite, OpenSearch
- Gitea PAT (get_gitea_token) for VCS
- None for Prometheus, Loki, S3, LiveKit

Fixes client URLs to match deployed routes: hydra→hydra.{domain},
matrix→messages.{domain}, grafana→metrics.{domain},
prometheus→systemmetrics.{domain}, loki→systemlogs.{domain}.

Removes all ad-hoc token helpers from CLI modules (matrix_with_token,
os_client, people_client, etc). Every dispatch just calls
client.service().await?.

sunbeam-sdk/src/monitoring/cli.rs

@@ -425,7 +425,7 @@ async fn dispatch_prometheus(
     client: &SunbeamClient,
     fmt: OutputFormat,
 ) -> Result<()> {
-    let prom = client.prometheus();
+    let prom = client.prometheus().await?;
     match action {
         PrometheusAction::Query { query, time } => {
             let res = prom.query(&query, time.as_deref()).await?;
@@ -511,7 +511,7 @@ async fn dispatch_loki(
     client: &SunbeamClient,
     fmt: OutputFormat,
 ) -> Result<()> {
-    let loki = client.loki();
+    let loki = client.loki().await?;
     match action {
         LokiAction::Query { query, limit, time } => {
             let res = loki.query(&query, limit, time.as_deref()).await?;
@@ -631,7 +631,7 @@ async fn dispatch_grafana_dashboard(
     client: &SunbeamClient,
     fmt: OutputFormat,
 ) -> Result<()> {
-    let grafana = client.grafana();
+    let grafana = client.grafana().await?;
     match action {
         GrafanaDashboardAction::List => {
             let items = grafana.list_dashboards().await?;
@@ -696,7 +696,7 @@ async fn dispatch_grafana_datasource(
     client: &SunbeamClient,
     fmt: OutputFormat,
 ) -> Result<()> {
-    let grafana = client.grafana();
+    let grafana = client.grafana().await?;
     match action {
         GrafanaDatasourceAction::List => {
             let items = grafana.list_datasources().await?;
@@ -746,7 +746,7 @@ async fn dispatch_grafana_folder(
     client: &SunbeamClient,
     fmt: OutputFormat,
 ) -> Result<()> {
-    let grafana = client.grafana();
+    let grafana = client.grafana().await?;
     match action {
         GrafanaFolderAction::List => {
             let items = grafana.list_folders().await?;
@@ -794,7 +794,7 @@ async fn dispatch_grafana_annotation(
     client: &SunbeamClient,
     fmt: OutputFormat,
 ) -> Result<()> {
-    let grafana = client.grafana();
+    let grafana = client.grafana().await?;
     match action {
         GrafanaAnnotationAction::List { params } => {
             let items = grafana.list_annotations(params.as_deref()).await?;
@@ -833,7 +833,7 @@ async fn dispatch_grafana_alert(
     client: &SunbeamClient,
     fmt: OutputFormat,
 ) -> Result<()> {
-    let grafana = client.grafana();
+    let grafana = client.grafana().await?;
     match action {
         GrafanaAlertAction::List => {
             let items = grafana.get_alert_rules().await?;
@@ -879,7 +879,7 @@ async fn dispatch_grafana_org(
     client: &SunbeamClient,
     fmt: OutputFormat,
 ) -> Result<()> {
-    let grafana = client.grafana();
+    let grafana = client.grafana().await?;
     match action {
         GrafanaOrgAction::Get => {
             let item = grafana.get_current_org().await?;

sunbeam-sdk/src/monitoring/grafana.rs

@@ -27,9 +27,9 @@ impl ServiceClient for GrafanaClient {
 }
 
 impl GrafanaClient {
-    /// Build a GrafanaClient from domain (e.g. `https://grafana.{domain}/api`).
+    /// Build a GrafanaClient from domain (e.g. `https://metrics.{domain}/api`).
     pub fn connect(domain: &str) -> Self {
-        let base_url = format!("https://grafana.{domain}/api");
+        let base_url = format!("https://metrics.{domain}/api");
         Self::from_parts(base_url, AuthMethod::None)
     }
 
@@ -410,7 +410,7 @@ mod tests {
     #[test]
     fn test_connect_url() {
         let c = GrafanaClient::connect("sunbeam.pt");
-        assert_eq!(c.base_url(), "https://grafana.sunbeam.pt/api");
+        assert_eq!(c.base_url(), "https://metrics.sunbeam.pt/api");
         assert_eq!(c.service_name(), "grafana");
     }
 

sunbeam-sdk/src/monitoring/loki.rs

@@ -27,9 +27,9 @@ impl ServiceClient for LokiClient {
 }
 
 impl LokiClient {
-    /// Build a LokiClient from domain (e.g. `https://loki.{domain}/loki/api/v1`).
+    /// Build a LokiClient from domain (e.g. `https://systemlogs.{domain}/loki/api/v1`).
     pub fn connect(domain: &str) -> Self {
-        let base_url = format!("https://loki.{domain}/loki/api/v1");
+        let base_url = format!("https://systemlogs.{domain}/loki/api/v1");
         Self::from_parts(base_url, AuthMethod::None)
     }
 
@@ -254,7 +254,7 @@ mod tests {
     #[test]
     fn test_connect_url() {
         let c = LokiClient::connect("sunbeam.pt");
-        assert_eq!(c.base_url(), "https://loki.sunbeam.pt/loki/api/v1");
+        assert_eq!(c.base_url(), "https://systemlogs.sunbeam.pt/loki/api/v1");
         assert_eq!(c.service_name(), "loki");
     }
 

sunbeam-sdk/src/monitoring/prometheus.rs

@@ -27,9 +27,9 @@ impl ServiceClient for PrometheusClient {
 }
 
 impl PrometheusClient {
-    /// Build a PrometheusClient from domain (e.g. `https://prometheus.{domain}/api/v1`).
+    /// Build a PrometheusClient from domain (e.g. `https://systemmetrics.{domain}/api/v1`).
     pub fn connect(domain: &str) -> Self {
-        let base_url = format!("https://prometheus.{domain}/api/v1");
+        let base_url = format!("https://systemmetrics.{domain}/api/v1");
         Self::from_parts(base_url, AuthMethod::None)
     }
 
@@ -253,7 +253,7 @@ mod tests {
     #[test]
     fn test_connect_url() {
         let c = PrometheusClient::connect("sunbeam.pt");
-        assert_eq!(c.base_url(), "https://prometheus.sunbeam.pt/api/v1");
+        assert_eq!(c.base_url(), "https://systemmetrics.sunbeam.pt/api/v1");
         assert_eq!(c.service_name(), "prometheus");
     }