feat(auth): add typed IAM NemoClient

[maxdubrinsky]

Summary

• Add typed sync and async IAM clients for role-binding CRUD, PDP authorization evaluation, and OPA bundle retrieval.
• Share the IAM wire DTOs with the Auth service without changing OIDC discovery/bootstrap or nmp_common.AuthClient.
• Preserve binary response metadata after reads and scope HTTP 304 acceptance to endpoints that explicitly declare it.
• Model the structured FastAPI authorization 400 envelope and retain the existing public IAM/OpenAPI contracts.

Validation

• 216 IAM/client/Auth tests passed after merging current main; 4 slow stress tests skipped by the standard suite.
• Ruff, formatting, focused ty, deterministic OpenAPI regeneration, and git diff --check passed.
• Independent adversarial review found no blocker.

Exclusions

OIDC discovery/bootstrap and nmp_common.AuthClient remain unchanged by design.

Linear: https://linear.app/nvidia/issue/AIRCORE-878

[github-actions]

Suite	Lines Covered	Line Rate	Branch Rate
Unit Tests	26445/34091	77.6%	61.8%
Integration Tests	15232/32716	46.6%	18.7%