Deferred storage, device authorization and OAuth API support #60

Why

These storage, device authorization and OAuth routes need designed workflows and source-owned generation. Kevin moved all contract-generated endpoints out of Python SDK 2.0; 2.0 ships asyncio over the existing handwritten surface plus Python 3.12+.

Wait for https://github.com/transloadit/api2/pull/9252 (API2-owned SDK emitters, owned by the existing studio1/~/code/api2 session). The broader deferred Python generation work and recovery snapshot are tracked in #61. A future release version will be agreed after that dependency is ready.

The previously identified separate-product routes from API2 27622f3ecd09ffef6fc86a43dcfe14b95deaaad6, api2/generated/contracts/v1/contract.json remain useful planning context:

• api2.storage-grants-create
• api2.storage-public-prefixes-list
• api2.storage-public-prefixes-declare
• api2.storage-public-prefixes-revoke
• api2.cli-device-authorizations-create
• api2.cli-device-authorizations-approve
• api2.cli-device-authorizations-deny
• api2.cli-device-authorizations-token
• api2.cli-device-authorizations-find
• api2.oauth-client-register
• api2.oauth-authorize-context
• api2.oauth-authorization-codes-create
• api2.oauth-revoke
• api2.oauth-connections-list
• api2.oauth-connection-revoke
• api2.revoke-own-auth-key

Design the storage/device-authorization/OAuth workflows with the producer-owned Python emitter. Test authentication selection, token handling and lifecycle cleanup. Delegated S3/MCP/Companion/Socket.IO protocols remain separate.

Context: #57

_{🤖 Released by kvz on framework1/python-sdk since 2026-10-11 · resume: codex resume 01a12c04-6ff8-7a91-9987-654db44d852e}