fix: send ESG country/domain as query params (matches [FromQuery] binding)

[aagarwal-apexanalytix]

Summary

Cross-repo audit of all 47 SDK methods against the live QubitOn API surfaced 1 issue: `lookupESGScore` was sending `country` and `domain` in the JSON body, but the server binds them as `[FromQuery]` on `ESGController` — they were silently dropped, causing scoring to default to global / no-domain results.

Same drift surface as the SAP, Oracle, and Go connector PRs:

• qubitonhq/qubiton-go#1
• qubitonhq/qubiton-oracle#2
• qubitonhq/qubiton-sap#2 (already merged)

Fix

Strip `country` and `domain` off the request body and serialise them into the URL query string with `URLSearchParams` (handles percent-encoding). The body now contains only `companyName`, `esgId`, and `BaseRequest` fields.

```ts
async lookupESGScore(req: EsgScoresRequest, options?: RequestOptions): Promise {
const { country, domain, ...body } = req;
const params = new URLSearchParams();
if (country) params.set('country', country);
if (domain) params.set('domain', domain);
const qs = params.toString();
const path = qs ? `/api/esg/Scores?${qs}` : '/api/esg/Scores';
return this.post(path, body, options);
}
```

Existing call sites that don't set `country`/`domain` see no behaviour change. Call sites that DO set them (intending to filter by region or domain) now correctly produce `?country=…&domain=…` on the URL.

`EsgScoresRequest.country` and `.domain` JSDoc updated to flag they are sent as query parameters, not body.

Audit findings outside this PR

46 of 47 SDK methods are correctly aligned with the API. Spot-checked:

Type	Status	Notes
`TaxValidateRequest`	✅	`identityNumber` / `identityNumberType` / `country` / `entityName` — matches renamed canonical TaxRequest
`TaxFormatValidateRequest`	✅	`identityNumber` / `identityNumberType` / `countryIso2` — model comment already calls out the rename trap
`BusinessRegistrationRequest`	✅	`entityName` (renamed from `companyName`)
`EntityRiskRequest.CountryOfIncorporation`	✅	PascalCase — matches the pinned `[JsonPropertyName("CountryOfIncorporation")]` override on the server DTO. Maintainer had already documented this trap in the model comment
`BeneficialOwnershipRequest`	✅	`countryIso2`
`CorporateHierarchyRequest`	✅	No `country` field (matches DTO; flagged back to API team)

The Node SDK is the cleanest of the four connector audits — the maintainer had already preempted three of the four common drift traps with pinned wire field names and documented JSDoc comments. Only the ESG query-string binding was missed.

Test plan

• `tsc --noEmit` clean
• `npm test` passes (22/22 tests)
• Existing call sites unaffected (`country`/`domain` were already optional)
• `URLSearchParams` handles percent-encoding for special characters
• Smoke test against the dev API and verify `?country=US&domain=acme.com` appears on the wire

Diff

`+19 / -1` across `src/client.ts` and `src/models.ts`.