Release 0.3.1: signup, subdomains dataset, Authlib OAuth - #17

refactor(sdk): hand OAuth token requests to Authlib 1.8.0 (0.3.1)

Regenerated request models from the platform spec: AppendParams.dataset
now allows "subdomains" (up to 300 known subdomains per domain).

Module-level rather than a client method because the client requires a
credential at construction and signup is the one call that has none.
Maps 409 to ValidationError since raise_for_status had no branch for
it and account-exists is a validation-style failure, not a generic error.

The only command that works before auth login, on purpose: it is how an
agent opens the account its human will later log into.

Without this, an agent (or a bug in one) could loop discolike signup /
discolike.signup() over arbitrary emails from one machine with nothing
in the way. Remembering the last signed-up email and requiring an
explicit override before switching adds friction to that specific
failure mode without touching normal single-account use.

A person with no account was bounced straight into a browser OAuth
flow that has nothing to authenticate against. Asking up front and
routing "no" into the same signup path discolike signup already uses
avoids that dead end without touching the existing login flow for
everyone who already has a key or credential.

A bad name currently only fails after a round trip to the API. Mirroring
PropelAuth's real rule client-side (probed and pinned in the API task)
means an agent gets the rejection immediately, with the same wording,
instead of waiting on a network call to learn the same thing.

The interactive account question only checked the login subcommand's
own --api-key, so `discolike --api-key X auth login` still got asked
and, on "no", discarded a key that was already good. It needed the
same option-source check the API-key login path itself already uses.
Also dedupes _is_interactive, which had drifted into two copies.

get_parameter_source for "method" was read off the root Click context,
which only tracks root-level options, so a --method passed to the login
subcommand was never detected as explicit and the account question still
fired for `auth login --method api_key`. Read it off the subcommand's own
context instead.

Also validate --method before offering signup, so an invalid method
errors immediately instead of asking the account question first.

Restores an assertion dropped from
test_login_forged_error_callback_cannot_evict_stored_client during an
earlier commit on this branch.

The punctuation whitelist rejected real names PropelAuth itself
accepts (digits, parentheses, underscores, an email-shaped name).
Its only actual requirement is length; ours now adds just the two
things worth blocking client-side before a round trip: no
angle-bracket/control-character injection, and at least one letter.

CI type-checks the tests directories.