Simplified auth configuration

This release adds a dangerousApiKey auth option for quick dev and testing without a backend session endpoint, and introduces a unified session field on ApiConfig.

Features

dangerousApiKey auth and unified session field #1611 - Added dangerousApiKey auth option that automatically exchanges an API key for a session token. Also introduced a unified session field on ApiConfig that accepts either a static token string or an async fetcher function. The previous sessionToken and sessionFn fields still work but are now deprecated. (Author: @walker-tx)