feat: async SunbeamClient factory with unified auth resolution

SunbeamClient accessors are now async and resolve auth per-client:
- SSO bearer (get_token) for admin APIs, Matrix, La Suite, OpenSearch
- Gitea PAT (get_gitea_token) for VCS
- None for Prometheus, Loki, S3, LiveKit

Fixes client URLs to match deployed routes: hydra→hydra.{domain},
matrix→messages.{domain}, grafana→metrics.{domain},
prometheus→systemmetrics.{domain}, loki→systemlogs.{domain}.

Removes all ad-hoc token helpers from CLI modules (matrix_with_token,
os_client, people_client, etc). Every dispatch just calls
client.service().await?.

sunbeam-sdk/src/search/cli.rs

@@ -6,17 +6,6 @@ use serde_json::json;
 use crate::error::Result;
 use crate::output::{self, OutputFormat};
 
-// ---------------------------------------------------------------------------
-// Client helper
-// ---------------------------------------------------------------------------
-
-async fn os_client(domain: &str) -> Result<super::OpenSearchClient> {
-    let token = crate::auth::get_token().await?;
-    let mut c = super::OpenSearchClient::connect(domain);
-    c.set_token(token);
-    Ok(c)
-}
-
 // ---------------------------------------------------------------------------
 // Top-level command enum
 // ---------------------------------------------------------------------------
@@ -413,7 +402,7 @@ pub async fn dispatch(
     client: &crate::client::SunbeamClient,
     fmt: OutputFormat,
 ) -> Result<()> {
-    let c = os_client(client.domain()).await?;
+    let c = client.opensearch().await?;
 
     match cmd {
         // -----------------------------------------------------------------