Add client signal attribution

[aezell]

Summary

• add privacy-safe client-signal attribution to authenticated REST and WebSocket requests
• centralize attributed authorization headers and preserve the credential-minting boundary
• support process-wide caching and the SPRITES_CLIENT_SIGNALS opt-out
• consume client_signals v0.4.4 from Hex, including Grok Build detection

User impact

The Fly backend can attribute sprites-ex traffic to interactive users, automation, and supported agents without receiving command arguments or raw environment values. Users can disable signal detection while retaining the SDK user agent.

Testing

• mix deps.get resolved client_signals 0.4.4 from Hex
• mix format --check-formatted passed
• mix compile --warnings-as-errors passed
• mix test: 48 passed
• git diff --check passed

Deployment

No backend deployment is required. Hex client_signals v0.4.4 is public and locked by checksum.