Add typed principal settings, auth-session, and administrative metadata services

[terjekv]

Gap

The remaining low-level identity and operator endpoints are callable through client.openapi but have no discoverable typed services. They include:

• current/principal settings get/put/patch/delete and group discovery;
• authentication providers and token validation;
• logout by token, user ID, or all sessions;
• running admin configuration;
• meta counts, database state, task-queue state, and login-rate-limit inspect/release operations.

These endpoints are lower-frequency than resource CRUD, but they are important for administration, diagnostics, and complete identity lifecycle management.

Acceptance criteria

• Add typed principal settings and settings-revision models, including JSON Patch and Merge Patch support without guessing wire fields.
• Add typed provider/validation and administrative logout request/response models.
• Add typed running-config and meta state models.
• Group methods into coherent principal/auth/admin services rather than one flat client namespace.
• Mark public versus authenticated operations exactly as v0.0.9 requires.
• Preserve sync/async parity and secret-safe handling for token/session controls.
• Add unit coverage for every route group and pinned-server coverage where operations are safe and deterministic.
• Document authorization requirements and destructive session/rate-limit actions.