python(refactor): group access control APIs under client.access_control

[wei-qlu]

Summary

Groups access-control APIs under:

client.access_control
client.async_.access_control

This keeps resource and principal attributes together under one access-control surface, with room for future APIs.

• Added sync and async access_control namespaces.
• Moved resource and principal attribute APIs under client.access_control.
• Improved assignment ergonomics:
  • assign() accepts key objects or key IDs.
  • Resource assignments accept resource objects, raw resource IDs, or ResourceAttributeEntity.
  • Principal assignments accept user IDs, and user emails for USER principals.

Example

key = client.access_control.resource_attributes.get_or_create_key(
    "licenses",
    ResourceAttributeKeyType.SET_OF_ENUM,
)
licenses = key.get_or_create_enum_values(["LICENSE_A", "LICENSE_B"])
key.assign_to([channel], value=licenses)

Validation

• Unit tests and Manual QA of creating resource and principal attributes through the new namespace.

[github-actions]

Python docs preview: https://sift-stack.github.io/sift/python/pr-666/

Deployed from 4db0c3b. The link may take up to a minute to become live as GitHub Pages propagates.

[alexluck-sift]

Re-reviewed after the latest round. All my earlier feedback is addressed, and I ran a full audit of the current surface: the touched-area unit tests (151) pass, and mypy and pyright are clean. Sync/async parity, exports, and client wiring all check out. Overall the PR is in strong shape.

Two items with real user impact are inline as requested changes (both small). The rest are non-blocking and prefixed as such.

One extra note, non-blocking, on test coverage: the suite passes but a few branches are unexercised. A NUMBER key given a bool, a SET_OF_ENUM key given a scalar, the falsy numeric value 0 (only 5 is tested), the modified_after filter, and an assertion that UNSPECIFIED stays out of the public enums. Cheap to add and they guard real edges.