fix: stop request() from refusing an Endpoint with no Current login

[diegolmello]

Proposed changes

Api.request refused every Endpoint called with no Current login, throwing requires a login inside the SDK without any request reaching the server. This broke registration, password recovery and confirmation email for every new user.

The auth flag never controlled the auth headers — those are attached by setLogin from the Current login, independently of it. Its only effect was that guard, a client-side pre-flight duplicating a decision only the server can make, so it could only produce false negatives.

• Removed the guard and the auth parameter from request, the four verb wrappers (post, get, put, del), and IAPIRequest.
• Swept all 15 call sites that passed the slot positionally, including info(), which passed this.loggedIn().
• loggedIn() stays public and unchanged.
• Deleted the dead commented-out login/logout block in lib/api/api.ts.

Breaking for positional callers: dropping the third slot shifts every later positional argument. TypeScript consumers get a compile error, but an untyped api.get('x', {}, true) would now bind true to ignore. No caller in this repo still passes it.

Steps to reproduce

1. Construct an Api with no Login, so currentLogin is null.
2. Call post on an Endpoint that needs no session, e.g. users.forgotPassword.
3. Before: throws requires a login and the REST client is never called. After: the Endpoint and payload reach the REST client.

Tests

• Api with no Current login > sends the Endpoint to the REST client with no Current login
• Api with no Current login > sends info() with the auth headers once a Current login is held
• client.logout > reports itself logged out
• client.logout > still sends an Endpoint to the REST client