fix: give each client its own API key instead of a shared global

[mikipalet]

Why

The auth interceptor was registered on the module-global HTTP client that sdk.gen.ts exports, so every new Zernio({ apiKey }) stacked another interceptor onto the same shared client. All of them run on every request, each overwriting Authorization, so the last-constructed key won for all in-flight requests.

In a process serving more than one tenant, one tenant's call could go out carrying another tenant's token and return their data. Two concurrent requests in one instance is enough. Interceptors were also never removed, so they accumulated for the process lifetime.

const a = new Zernio({ apiKey: "sk_AAAA" });
const b = new Zernio({ apiKey: "sk_BBBB" });
await a.accounts.listAccounts({});
// before: Bearer sk_BBBB     after: Bearer sk_AAAA

Reported as zernio-dev/zernflow#18, found while fixing an unrelated issue there.

What

• Each Zernio instance creates its own client via createClient(createConfig(...)). Every namespace method is routed through it by _bind, which reads _client at call time rather than bind time, because class fields initialize before the constructor body runs. _bind<F>(op: F): F preserves each operation's declared signature, so no consumer-visible type changes.
• baseURL and defaultHeaders move onto that client for the same reason: they were global too.
• scripts/generate-client.ts emits this shape. Verified byte-identical to the committed src/client.ts against the current live spec, so the next automated regeneration cannot silently revert it.
• tests/isolation.test.ts pins the behaviour: per-instance keys, an earlier instance surviving a later construction, no interceptor stacking across 25 instances, per-instance baseURL and defaultHeaders, and errors still surfacing.

Compatibility

The raw operations and the global client are not exported from src/index.ts (it exports only Zernio, the error classes, and types.gen), so no documented consumer depended on the global being configured. npm run lint, typecheck and all 173 tests pass; 4 of the 6 new tests fail on the pre-fix client.

🤖 Generated with Claude Code