feat: SDK auth/client config factories (bearerToken, browserSession, createSentryClient)

[betegon]

What

First of three small, additive PRs making @sentry/api a one-line-to-configure client for the CLI, MCP, and frontend, instead of threading baseUrl + auth into every call.

This PR adds the auth/init factories and exposes the client from the public entry. No region routing yet (PR2), no query-accuracy helper (PR3).

Changes

• lib/auth-config.ts (new): bearerToken({ token, baseUrl?, fetch?, headers?, throwOnError? }) — a pure factory returning a typed config. Defaults baseUrl to https://sentry.io. Standalone (local types, no generated imports), same pattern as lib/sentry-pagination.ts.
• lib/browser-client.ts: add browserSession() as the blessed name for the existing cookie+CSRF createBrowserSdkConfig (kept as an alias).
• build.mjs: copy auth-config.ts into the build and re-export from the public entry: bearerToken, client, createClient, createClient as createSentryClient, createConfig, and the Config type. (client/createClient were not exported before, despite the browser docstring assuming import { client }.)
• README.md: lead with configure-once usage; document the isolated-client and browser paths. Retires "pass baseUrl to each call."

Design

• Factories named by auth method (bearerToken, browserSession); host/routing are options, not separate factories. No configure, no init, no mode enum, no "SaaS."
• client.setConfig(...) (global singleton) for the CLI; createSentryClient(...) (isolated instance) for servers like MCP and for tests, so a multi-token server never shares global mutable auth state.

Usage

import { client, bearerToken, listYourOrganizations } from "@sentry/api";
client.setConfig(bearerToken({ token: process.env.SENTRY_AUTH_TOKEN }));
const { data } = await listYourOrganizations();   // no per-call baseUrl/headers

Test plan

• bun test: 97 pass / 0 fail (8 new in test/auth-config.test.ts).
• bun run build: green; bun run typecheck: clean.
• Verified the built package: bearerToken -> sentry.io + Bearer header; createSentryClient/createClient/client.setConfig resolve; browserSession() -> baseUrl: ''; isolated client instantiates.

Not in scope (follow-ups)

• PR2: resolveRegionUrl option + per-request region routing (default = sentry.io proxy).
• PR3: queryWithAccuracy (progressive sampling), + backend follow-up to add sampling to the spec.
• No CLI/MCP wiring until all three land.