[sdk-service-delegation] act_as_user_id constructor param

[artugro]

Context

wisdom-agents needs to make network calls on behalf of specific users (its entity owners) without each user handing over an API key. The wisdom side gains a service-key + X-On-Behalf-Of delegation mode (see companion ticket). This ticket adds matching support to the SDK.

Scope

Minimal additive change: a new optional constructor param that, when set, attaches an X-On-Behalf-Of header to every request.

class IntunoClient:
    def __init__(
        self,
        api_key: str,
        base_url: str = DEFAULT_BASE_URL,
        timeout: float = 30.0,
        *,
        act_as_user_id: Optional[Union[UUID, str]] = None,
    ):
        ...

class AsyncIntunoClient:
    def __init__(
        self,
        api_key: str,
        base_url: str = DEFAULT_BASE_URL,
        timeout: float = 30.0,
        *,
        act_as_user_id: Optional[Union[UUID, str]] = None,
    ):
        ...

When act_as_user_id is set:

• Every outbound request carries X-On-Behalf-Of: <uuid> alongside the normal auth header
• The api_key passed in is expected to be the service key (the backend enforces this; SDK doesn't judge)
• X-Service-Key header used instead of / alongside X-API-Key — match whatever the backend ticket lands on (recommend X-Service-Key for clarity, sent only when act_as_user_id is present)

Header layout (final)

Scenario	Headers
Normal SDK user	X-API-Key: wsk_... (or Authorization: Bearer eyJ...)
Service delegation	X-Service-Key: <service-secret> + X-On-Behalf-Of: <user_uuid>

Keep them mutually exclusive in the SDK — if act_as_user_id is set, drop X-API-Key and send X-Service-Key instead. Backend's new auth dep accepts either pattern.

Version bump

Additive change; constructor-compatible. 0.4.0 → 0.5.0 (MINOR).

Acceptance criteria

• act_as_user_id kwarg on both client constructors
• Unit tests cover:
  • no act_as_user_id → no X-On-Behalf-Of header, X-API-Key sent
  • act_as_user_id=<uuid> → both X-Service-Key and X-On-Behalf-Of sent, no X-API-Key
• CHANGELOG.md entry under 0.5.0
• README snippet under "Advanced / service delegation"
• PyPI release

Out of scope

• New methods or endpoints — purely a header-plumbing change
• Per-call override of act_as_user_id — the constructor is per-entity-client anyway

Relates to

• wisdom [personal-service-auth] — companion backend work
• wisdom-agents [personal-agents-delegation] — main consumer of this change