feat(forward): add SAT issuance and revocation

[moonyue-w]

Summary

The SDK can exchange a platform SAT but cannot explicitly issue or revoke Forward-bound SATs. Add ServiceAccountTokens.New / Revoke and Identities.ServiceAccountTokens.New with typed responses, a runnable example, API documentation, and opt-in integration coverage.

Why

Applications need administrator SATs, Identity-scoped SATs, and precise revocation of their Forward bindings. These three methods use an explicit per-call SA Key in Authorization, omit the Key from JSON, and disable automatic retries even if request/client options allow them. Existing PAT/SAT business authentication and platform Credential exchange remain unchanged.

Verification

• make lint
• make build
• make test
• make docs-check
• go build ./examples/...
• Account-backed integration tests run

Commands and results:

make test-live-sa-tokens: CN and Global passed (2 cases)
Forward SAT example: CN and Global administrator mode passed
Focused race checks and changelog validation passed

Each live case issued an administrator and Identity SAT, verified business access and cross-Identity 403, revoked both tokens, verified immediate 401, and deleted both temporary Identities. No model execution was needed. The two example runs also revoked their tokens.

Impact

• Public API or behavior changed
• User-facing changes added to CHANGELOG.md under Unreleased
• Generated API documentation updated
• Forward contract fixtures updated
• Python and TypeScript parity considered
• Migration notes added for a breaking change
• No credentials, .env.live, logs, or generated test output committed

This is additive; no migration is required. Revocation affects the Forward binding, not unrelated Managed/platform access or an already-running Session. Static issued SATs are renewed by the caller. This PR does not include Realtime.