feat: rest + grpc for orgs, SSO, SCIM, org domains; full protocol coverage

[lakhansamani]

Brings the SDK to full protocol coverage against server 2.4.0.

What changed

26 admin methods that were gqlOnly gained proto RPCs and REST bindings in authorizer #739 — organizations, org members, org domains, org OIDC/SAML connections and SCIM endpoints.

A further 5 — AdminLogout, AdminSession, AdminMeta, FgaGetModel, FgaReset — were rest+grpc-only despite each having a GraphQL op on the server. All now span three protocols, leaving AdminSignup, UpdateEnv and GenerateJWTKeys graphql-only (no proto RPC exists for them).

Not a breaking change

The 26 keep their hand-written request/response types. Those signatures return the bare domain object while the proto response wraps it, so adminMethodSpec gains responseUnwrap — the dual of the existing graphqlWrap. AdminMeta/FgaGetModel need the opposite (graphqlWrap), since their proto responses nest while the GraphQL ops return the object directly.

A wrong unwrap yields a zero-valued struct rather than an error, so the tests assert real field values over every protocol. Mutation-tested: clearing CreateOrganization's unwrap fails rest and grpc while graphql still passes.

REST for these decodes into the proto message first, via the new restResponse. grpc-gateway emits int64 as a JSON string and doREST only applies protojson to proto.Message targets, so decoding straight into a domain type failed on every timestamp.

Three pre-existing bugs fixed

• ListOrganizationsRequest, ListOrgMembersRequest and ListOrgDomainsRequest typed their pagination field as PaginatedRequest, itself a {pagination:{...}} envelope, so the payload nested pagination twice and the server ignored it.
• _verification_requests, _webhooks and _email_templates declared $data: PaginatedRequest, a type the schema does not define — all three failed over graphql with Unknown type.
• REST could not decode int64 into any hand-written type (see above).

Verification

Full suite green against a live 2.4.0 server, including new cross-protocol tests for the org surface and the admin-meta surface. go vet clean.

Depends on authorizer-proto-go v0.2.0-rc.0 (released); the local replace is dropped.