refactor: contract CANFAR interfaces while preserving behavior

[shinybrar]

Outcome

Contracts CANFAR internal interfaces and removes redundant machinery while preserving the shipped Python API, CLI, Configuration data, authentication, HTTP, Session, storage, logging, packaging, and documentation behavior.

Net epic change: 320 files, 9,069 insertions, 16,706 deletions across 142 commits; net reduction of 7,637 lines.

Highlights

• keep native httpx Client and AsyncClient implementations while sharing request, response, filtering, logging, credential, and OIDC policy
• preserve Session and AsyncSession signatures and return shapes; keep ps as a thin CLI operation over fetch
• make config.editor the editing surface and apply related domain transitions atomically
• split registry, VOSI, storage, transport, and enrichment implementation behind the stable canfar.server interface
• flatten canonical CLI commands and add leaf -o/--output json or yaml with strict create -- handling and data-only stdout
• expose explicit storage identifiers and filesystem resolution without dynamic protocol registration or automatic persistent caching
• modernize X.509 handling, consolidate CI, and simplify test surfaces around public CliRunner and httpx MockTransport contracts
• replace ALMA screenshots with text-first workflows and audit all documentation for truthful APIs, links, navigation, examples, and buildability
• retain Overview, funny.name and its packaged scientist wordlist, distributed helpers, and Hatch force-include

Compatibility guarantees

• public Session and AsyncSession method contracts and raw Python return values remain unchanged
• persisted Configuration shape remains readable and stable
• native synchronous behavior does not depend on an event loop
• machine JSON and YAML output remains filtered, data-only, and derived from the same Python or Pydantic result
• runtime bearer tokens and certificates retain precedence over saved Authentication Records and refresh hooks
• public canfar.server discovery, enrichment, and error imports remain available

Review

• Standards, Specification, and Simplify reviews were run after every implementation wave
• final Standards, Specification, Thermonuclear, Ponytail, Deslop, Architecture, and Simplify reviews are clean
• all github-code-quality review threads were addressed with focused commits, replied to, and resolved

Validation

• GitHub CI passes across Python 3.10 through 3.14
• CodeQL, dependency review, and pre-commit checks pass
• 844 deterministic non-slow tests pass locally
• Ruff, ty, uv lock validation, and git diff checks pass
• MkDocs builds successfully; the only message is the known external git-committers API rate-limit warning
• wheel and sdist build successfully and include funny.py plus scientists.txt; funny.name runs from the built wheel

The credential-dependent full integration suite was not run because no live CANFAR Authentication Record and certificate were available, per repository policy.

Closes #244.