feat(clients): add AuthStrategy pattern for extensible client auth

[AtMrun]

Summary

• Introduces an AuthStrategy protocol (clients/auth.py) that maps typed Credential instances to client connection parameters (URL params, connect_args, query params, HTTP headers)
• Implements 8 built-in strategies: BasicAuthStrategy, KeypairAuthStrategy, OAuthAuthStrategy, ApiKeyAuthStrategy, BearerTokenAuthStrategy, IamUserAuthStrategy, IamRoleAuthStrategy, ServicePrincipalAuthStrategy
• Flattens client hierarchy: ClientInterface ABC → concrete Client base class with AUTH_STRATEGIES (typed as ClassVar) and _resolve_strategy / _build_url helpers
• Renames for clarity: BaseSQLClient → SQLClient, AsyncBaseSQLClient → AsyncSQLClient, BaseClient → HTTPClient, base.py → http.py
• Adds load_with_credential(credential, **connection_params) on both SQLClient and AsyncSQLClient as the strategy-based alternative to load(dict)
• Migrates AzureClient to AUTH_STRATEGIES, collapses azure/ package → single azure.py
• Adds ServicePrincipalCredential to the credential type registry

Hardening (latest commit)

• Removes mutable class-level credentials / resolved_credentials dicts — assigned only in __init__
• AUTH_STRATEGIES annotated as ClassVar to prevent accidental runtime mutation
• All assert isinstance(...) in strategies replaced with raise TypeError(...) so checks survive Python -O

What a multi-auth client looks like

class SnowflakeClient(SQLClient):
    DB_CONFIG = DatabaseConfig(
        template="snowflake://{username}@{account}/{database}",
        required=["username", "account"],
    )
    AUTH_STRATEGIES = {
        BasicCredential: BasicAuthStrategy(),
        CertificateCredential: KeypairAuthStrategy(),
        OAuthClientCredential: OAuthAuthStrategy(
            url_query_params={"authenticator": "oauth"},
        ),
    }

Three auth methods. Zero branching logic.

Test plan

• Unit tests for individual auth strategies (test_auth_strategies.py)
• Integration tests for Client base class (test_authenticated_client.py)
• Integration tests for load_with_credential on both sync and async clients (test_sql_auth_strategies.py)
• Legacy path tests: load(dict) still works unchanged
• All 129 client unit tests pass
• Pre-commit (ruff, ruff-format, pyright, isort) passes

🤖 Generated with Claude Code

[snykgituser]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[Aryamanz29]

v3 relevance check: ✅ Active feature — AuthStrategy pattern. Duplicate #1284 was closed. @AtMrun is this still the active branch?