feat: initial kmsvc-sdk Go client for kafkamgmt.v1 message-plane API

Client/auth/message-plane methods/long-poll/typed errors, all tested
against an in-process bufconn fake. Consumes [email protected] via
go get (GOPRIVATE), no submodule or local codegen.

auth.go

@@ -0,0 +1,46 @@
+package kmsvc
+
+import (
+	"context"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/metadata"
+)
+
+// TokenSource supplies a bearer token for each outgoing call. Implementations
+// must be safe for concurrent use.
+type TokenSource interface {
+	Token(ctx context.Context) (string, error)
+}
+
+// StaticToken is a TokenSource that always returns the same token. Useful for
+// tests and one-off scripts; not suitable for long-lived processes since the
+// token is never refreshed.
+type StaticToken string
+
+func (t StaticToken) Token(ctx context.Context) (string, error) {
+	return string(t), nil
+}
+
+// authUnaryInterceptor attaches the bearer token to outgoing gRPC metadata.
+func authUnaryInterceptor(source TokenSource) grpc.UnaryClientInterceptor {
+	return func(ctx context.Context, method string, req, reply any, cc *grpc.ClientConn, invoker grpc.UnaryInvoker, opts ...grpc.CallOption) error {
+		tok, err := source.Token(ctx)
+		if err != nil {
+			return err
+		}
+		ctx = metadata.AppendToOutgoingContext(ctx, "authorization", "Bearer "+tok)
+		return invoker(ctx, method, req, reply, cc, opts...)
+	}
+}
+
+func authStreamInterceptor(source TokenSource) grpc.StreamClientInterceptor {
+	return func(ctx context.Context, desc *grpc.StreamDesc, cc *grpc.ClientConn, method string, streamer grpc.Streamer, opts ...grpc.CallOption) (grpc.ClientStream, error) {
+		tok, err := source.Token(ctx)
+		if err != nil {
+			return nil, err
+		}
+		ctx = metadata.AppendToOutgoingContext(ctx, "authorization", "Bearer "+tok)
+		return streamer(ctx, desc, cc, method, opts...)
+	}
+}