feat: add organization templates, B2B integration config, and network ACL HMAC signatures

[fern-api]

Breaking Changes ⚠️

• Client app_type b2b_integration removed: the b2b_integration value is removed from the allowed client app_type values and is rejected on create/update. Configure a B2B integration through the new b2b_integration_configuration field instead.
• Event stream tenant context: EventStreamCloudEventContextTenant renames its tenant_id field to id (wire name tenant_id -> id). Code reading .tenant_id on this event-stream context object must read .id instead.

Added

• Organization templates: new management.organization_templates client with list, create, get, update, and list_organizations for managing reusable organization templates, plus management.organizations.organization_template (get, assign_organization_template, unassign_organization_template) to assign a template to an organization. Access tokens can now be scoped with the new create:, read:, and update:organization_templates permissions.
• Client B2B integration configuration: management.clients create/update now accept b2b_integration_configuration, with an integration_type of custom_auth_server, third_party, or application, to configure a client as a B2B integration. Client, update, and rotate-secret responses expose the same field.
• Network ACL HTTP Message Signatures: Network ACL rules now support an optional http_message_signature match under match / not_match, and management.keys.network_acls gains a delete method to remove a signing key. Access tokens can now be scoped with the new delete:network_acl_keys permission.
• Connection profile SCIM provisioning: management.connection_profiles create/update now accept a provisioning object to configure SCIM provisioning, including tokens, token scopes, and default/max token expiry. Connection profile responses expose the same field.
• Connections: OIDC and Okta connection options gain Pushed Authorization Request support (enable_pushed_authorization_requests, pushed_authorization_request_endpoint, require_pushed_authorization_requests), and SAML connection options gain discovery_url, oidc_metadata, and cross_app_access_resource_app.
• Tenant settings: TenantSettingsFlags gains a local_resource_discovery flag controlling whether the Local Resource Discovery endpoint is enabled.
• Forms: FormWidgetGMapsAddressConfig gains a server_key field.
• Action triggers: the action trigger type post-credential-validation is now supported, and screen groups gain consent-tenant-scopes.
• Errors: a new UnprocessableEntityError maps HTTP 422 responses.

Fixed

• management.connections (raw client) now surfaces 422 errors instead of an unhandled response.
• management.connections.scim_configuration (raw client) now surfaces 409 errors instead of an unhandled response.
• management.users.organizations.list: docstring now documents checkpoint pagination (from / take / next). No signature or type change.

[kishore7snehil]

LGTM!