feat(forward): add SAT issuance and revocation

[moonyue-w]

Summary

The SDK can exchange a platform SAT but cannot explicitly issue or revoke Forward-bound SATs. Add serviceAccountTokens.create / revoke and identities.serviceAccountTokens.create with typed responses, a runnable example, API documentation, and opt-in integration coverage.

Why

Applications need administrator SATs, Identity-scoped SATs, and precise revocation of their Forward bindings. These three methods use an explicit per-call SA Key in Authorization, omit the Key from JSON, and disable automatic retries even if request/client options allow them. Existing PAT/SAT business authentication and platform Credential exchange remain unchanged.

Verification

• npm run build
• npm run typecheck
• npm test
• npm run docs:check
• Relevant examples run or import successfully
• Account-backed integration tests run

Commands and results:

Offline suite: 3588 passed, 0 skipped
npm run test:live:sa:tokens: CN and Global passed (2 cases)
Forward SAT example: CN and Global administrator mode passed
npm pack --dry-run and changelog validation passed

Each live case issued an administrator and Identity SAT, verified business access and cross-Identity 403, revoked both tokens, verified immediate 401, and deleted both temporary Identities. No model execution was needed. The two example runs also revoked their tokens.

Impact

• Public API or behavior changed
• User-facing changes added to CHANGELOG.md under Unreleased
• CommonJS, ESM, and subpath exports remain valid
• Generated API documentation updated
• Contract or wire-field fixtures updated
• Go and Python parity considered
• Migration notes added for a breaking change
• No credentials, .env.live, logs, or generated test output committed

This is additive; no migration is required. Revocation affects the Forward binding, not unrelated Managed/platform access or an already-running Session. Static issued SATs are renewed by the caller. This PR does not include Realtime.