Feat/auth providers

[spartan124]

Pluggable Authentication Provider Architecture

Description

This PR introduces a pluggable authentication architecture via a new AuthenticationProvider interface, allowing the SDK to support future authentication methods (like OAuth, JWTs, SIWE, etc.) without tightly coupling them to the HttpClient or GuildPassClient.

Changes

• Added AuthenticationProvider Interface: Introduced the AuthenticationProvider interface to abstract token injection and refresh logic.
• Created ApiKeyAuthenticationProvider: Extracted the legacy API key injection logic into its own provider, ensuring backward compatibility.
• Updated HttpClient: Refactored the HttpClient to consume AuthenticationProvider instead of a raw API key.
• Support for Token Refresh: Added an optional onUnauthorized hook to AuthenticationProvider, which the HttpClient calls automatically when it receives a 401 response, allowing the provider to fetch a new token and trigger a request retry.
• Updated GuildPassClientBuilder: Exposed .withAuthProvider(provider) for clean provider registration.
• Documentation: Added comprehensive documentation in docs/authentication.md outlining how to build and register custom authentication providers.
• Testing: Added unit tests to ensure that AuthenticationProvider correctly injects headers, triggers token refreshes on 401 Unauthorized responses, and that the SDK correctly falls back to legacy apiKey behavior when configured.

Motivation & Context

Fixes #352

Previously, HttpClient directly injected the X-API-Key header into outgoing requests. As the ecosystem expands, clients will need to authenticate using diverse strategies (e.g. Bearer tokens, wallet signatures). This refactor extracts authentication concerns from the HTTP transport layer, providing a modular design that is both backwards-compatible and future-proof.

How Has This Been Tested?

• Verified that apiKey configurations in GuildPassClient correctly map to ApiKeyAuthenticationProvider internally without breaking existing integrations.
• Ensured all test suites pass, specifically validating the X-API-Key behavior and verifying the new onUnauthorized retry loops.
• Run npm run lint, npm run typecheck, and npm run test:run locally to ensure no regressions.

[spartan124]

Totally unrelated. But when should we expect rewards?