feat(client-tokens): support ephemeral keys v2

[AdirAmsalem]

Summary

• Add expires_in, allowed_models, and constraints optional parameters to tokens.create()
• Add permissions and constraints optional fields to CreateTokenResponse
• New TokenConstraints, RealtimeConstraints, and TokenPermissions TypedDicts for type safety
• All new fields are optional — fully backward compatible

Usage

from decart import DecartClient

client = DecartClient(api_key="sk_...")

# Basic usage (unchanged)
token = await client.tokens.create()

# With expiry and model restrictions
token = await client.tokens.create(
    expires_in=120,  # seconds (1-3600, default 60)
    allowed_models=["lucy_2_rt", "mirage_v2"],
    constraints={"realtime": {"maxSessionDuration": 300}},
    metadata={"user_id": "abc123"},
)

print(token.api_key)        # "ek_..."
print(token.expires_at)     # "2026-03-22T09:18:00Z"
print(token.permissions)    # {"models": ["lucy_2_rt", "mirage_v2"]}
print(token.constraints)    # {"realtime": {"maxSessionDuration": 300}}

Test plan

• All 9 token tests pass (uv run pytest tests/test_tokens.py -v)
• Manual verification against live API with v2 fields

🤖 Generated with Claude Code