Add OAuth token provider and first authenticated append

[einari]

Stacked on #33 (connection strings): this branch is based on feature/connection-string-parser. Retarget to main after #33 merges.

Added

• Async OAuth client-credentials token provider: form POST to /connect/token, typed errors (TokenAuthorizationError, TokenRequestError, TokenResponseError), conservative 30 second caching when expires_in is absent, proactive refresh, one shared refresh for concurrent callers, and cancellation that does not break other callers. (Implement async OAuth token handling #3)
• Bearer token on every new gRPC call; the token is looked up per call, never fixed into the channel. (Implement async OAuth token handling #3)
• ChronicleClient: ensures an event store and the Default namespace, registers an event type with a non-empty JSON schema and appends to event-log, returning the sequence number. Channel and token resources close deterministically. (Complete the first authenticated append milestone #4)
• Wire conversion for UUIDs, dates, times, durations and concept wrappers.
• Runnable sample (Samples/append_event), a real getting-started page, an authentication and TLS page, and opt-in integration tests against a development kernel.

Changed

• skipTlsValidation (default true) now has behavior: it trusts the local kernel's self-signed certificate only for localhost and loopback addresses. Every other host is verified against trusted roots, and ca_certificates supplies a private CA. Host names are always checked.
• grpcio is a direct dependency.

Known limits

• Uses the cratis-chronicle-contracts 19.31.3 wheel (GitHub release asset, SHA-256 pinned; PyPI publication is not planned). The client calls the 19.x contract names, so 16.x kernels are not supported: event type registration fails with UNIMPLEMENTED there. Verified against cratis/chronicle:19.31.3-development.
• Not included: reactors, projections, reconnect, discovery, retry on UNAUTHENTICATED.

Fixed

• Invalidating the token provider while a refresh was in flight no longer lets that refresh put its stale token back in the cache, and callers after the invalidation no longer join it.
• A failed shared token refresh whose callers were all cancelled no longer leaves a never-retrieved exception.
• A failed event type registration is reported as an error instead of being ignored.

(#3, #4)