feat(ts-sdk): add curated provider client - #2964

Summary

Adds a first-class TypeScript ProviderClient for provider CRUD, idempotent ensure, and manual credential updates. It uses the existing authenticated Connect transport and leaves provider profiles and automatic refresh operations on the typed client.raw surface as focused follow-ups.

Related Issue

Closes #2963

Changes

• add client.providers plus standalone ProviderClient.connect()
• add curated ProviderDefinition, redacted ProviderRecord, and provider list options
• add create/get/list/update/delete/ensure with SDK-consistent validation and error mapping
• preserve protobuf 64-bit versions/timestamps as strings and support optimistic concurrency on updates
• document a per-sandbox provider credential-rotation workflow that does not expose credential plaintext to sandbox application code
• add in-memory transport tests covering request mapping, redaction, validation, errors, update, and ensure

The initial slice deliberately excludes provider profile management and automatic refresh (configure, status, delete, rotate) to keep this PR reviewable. Those RPCs remain fully typed through client.raw and can become nested curated clients in follow-up PRs.

Testing

• npm run lint
• npm run typecheck
• npm test — 99 tests passed; coverage remains above configured thresholds
• npm run build
• Unit tests added/updated
• E2E tests added/updated (not applicable; request/response behavior is covered with the in-memory Connect transport)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (not applicable; SDK README updated)

This is opened as a draft while the RFE is triaged. The implementation is offered for maintainer review and can be adjusted to the preferred public API before it is marked ready.