feat: introduce the MiakAPI coordinator SDK v4

[Mathieu2301]

Summary

• replace the legacy shared-secret callback client with a typed, ESM-only coordinator SDK
• implement managed lifecycle, atomic five-slice declarations, state mutations, events, calls, streaming, cancellation, and presence
• pin the public TypeScript API and canonical MessagePack codec to Miakapp-V3 commit b927789691dd8cdebc91b673853cdc6711fe057d and its sdk conformance profile
• ship v4 as 4.0.0-alpha.0 on the protected npm next tag

Safety and protocol behavior

• obtain short-lived credentials through an injected access-token provider and require secure relay URLs
• preserve uncertainty after transport handoff and never retry state changes, events, or calls automatically
• enforce ordered atomic declaration activation, session epochs, exact dictionaries, immutable snapshots, and generation-safe async callbacks
• bound frames, buffered bytes, values, declarations, calls, timers, and WebSocket resources
• redact unexpected application and transport errors while preserving safe application call errors
• drain GOAWAY, reject stale authentication expiry, and isolate stale reauthentication from replacement sessions

Migration

This is a breaking replacement for MiakAPI 3. The legacy constructor, Firestore lookup, mutable variables, page callbacks, and notification helpers are removed rather than emulated. The README documents the new coordinator model and directs UI automation users to miakapp.com.

Validation

• bun run check
  • strict TypeScript typecheck and build
  • 75 unit, integration, transport, resource, and adversarial tests (235 assertions)
  • Node.js 22 package smoke test
  • 11/11 canonical external sdk conformance scenarios
  • npm package dry run
• bun audit: no vulnerabilities
• canonical API and codec verified byte-for-byte against the pinned Miakapp-V3 commit
• GitHub Actions and runtime dependencies pinned to immutable versions