Extract AgentApiClient transport into conductor/client/ai

The /agent/* endpoint methods, SSE streaming, and auth-header logic move to
conductor.client.ai.agent_api_client.AgentApiClient (Configuration-first;
an explicit token= is sent as-is, preserving the api_key-as-bearer semantic).
AgentClient keeps its constructor, convenience surface, and AgentHttpClient
alias, and now composes the transport; its _client attribute proxies to the
transport's httpx client so existing test/mock injection keeps working.
OrkesClients gains get_agent_client(); conductor.client.ai gains exports.

Auth behavior is unchanged in this commit (the JWT-exp mint cache moved
verbatim, as a private copy); consolidation onto Configuration's token
machinery lands separately. Two deliberate edge changes: an empty standalone
server_url now resolves through Configuration's default-host rules instead of
producing relative-URL errors, and the sync token path caches per-instance
instead of process-wide (both unobserved by tests; both superseded next
commit).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: Kowser