Overhauled the library with several new features (#5)

## Summary

Updates the library to v4.5.1 of the App Store Connect API, and ships it as a breaking 2.0.0 release with pagination, API key authentication, rate limiting, and a lighter install for consumers.

## Breaking changes

- **Minimum platforms:** iOS 14, macOS 11, tvOS 14, watchOS 7, and visionOS 1.
- **Toolchain:** Swift 6.0+ (Xcode 16+). The package builds in the Swift 6 language mode.
- **Runtime:** requires `swift-openapi-runtime` 1.11.0 or later.

## Changes

- **API:** updated the OpenAPI specification to v4.5.1, covering 1,303 operations and 1,473 schemas.
- **Pagination:** the spec patch adds the undocumented `cursor` query parameter to the 465 paged operations. `PagedDocumentLinks.nextCursor` reads the cursor from a page, and `PagedSequence` iterates every page.
- **Authentication:** `APIKeyTokenProvider` signs ES256 tokens from an API key and reuses each one until a minute before it expires. `BearerAuthMiddleware` now accepts a token provider.
- **Rate limiting:** `RateLimitMiddleware` retries `429` responses, waiting for `Retry-After` or backing off exponentially.
- **Generated code:** committed to `Sources/ASConnectService/Sources/Public/Generated` instead of generated by a build plugin. Consumers now resolve 4 packages instead of 12, and Xcode no longer asks to trust a plugin.
- **Tooling:**
  - `make oas-download` now downloads, patches, generates, and checks the docs in one go.
  - New `make oas-generate`, `make oas-validate`, and `make doc-check` targets.
  - The generator is pinned in `Tools/`, and the DocC plugin is only resolved by the documentation targets.
- **Documentation:** the DocC catalog now lists every operation and schema in the spec, and the catalog and README are rewritten for the new APIs.
- **Housekeeping:** Apache 2.0 license headers on every Swift file, including `Package.swift` and the tests.

Reviewed-on: #5
Co-authored-by: Javier Cicchelli <javier@rock-n-code.com>

Tests/ASConnectService/Cases/Public/Middlewares/BearerAuthMiddlewareTests.swift

@@ -1,9 +1,24 @@
+// ===----------------------------------------------------------------------===
+//
+// This source file is part of the ASConnectService open source project
+//
+// Copyright (c) 2026 Röck+Cöde VoF. and the ASConnectService project authors
+// Licensed under Apache license v2.0
+//
+// See LICENSE for license information
+// See CONTRIBUTORS for the list of ASConnectService project authors
+//
+// SPDX-License-Identifier: Apache-2.0
+//
+// ===----------------------------------------------------------------------===
+
 import Foundation
 import HTTPTypes
 import OpenAPIRuntime
 import Testing
 
-@testable import ASConnectService
+// A non-testable import ensures that the middleware can be created from outside the module.
+import ASConnectService
 
 @Suite("BearerAuthMiddleware")
 struct BearerAuthMiddlewareTests {
@@ -32,17 +47,14 @@ struct BearerAuthMiddlewareTests {
         let middleware = BearerAuthMiddleware(token: .Token.jwt)
         let requestBody: HTTPBody = HTTPBody("request-body")
 
-        var receivedBody: HTTPBody?
-
-        _ = try await middleware.intercept(
+        // The next handler echoes the body back, so the test can read it.
+        let (_, receivedBody) = try await middleware.intercept(
             .get,
             body: requestBody,
             baseURL: .base,
             operationID: "createApp",
             next: { _, body, _ in
-                receivedBody = body
-
-                return (HTTPResponse(status: .created), nil)
+                (HTTPResponse(status: .created), body)
             }
         )
 
@@ -112,6 +124,67 @@ struct BearerAuthMiddlewareTests {
             }
         )
     }
+
+    @Test("Asks the token provider for a token on every request")
+    func asksTokenProviderOnEveryRequest() async throws {
+        let tokens = TokenSequence()
+        let middleware = BearerAuthMiddleware {
+            await tokens.next()
+        }
+
+        for expectedToken in ["token-1", "token-2"] {
+            _ = try await middleware.intercept(
+                .get,
+                body: nil,
+                baseURL: .base,
+                operationID: "listApps",
+                next: { interceptedRequest, _, _ in
+                    #expect(interceptedRequest.headerFields[.authorization] == "Bearer \(expectedToken)")
+
+                    return (HTTPResponse(status: .ok), nil)
+                }
+            )
+        }
+    }
+
+    @Test("Rethrows the token provider error without calling the next handler")
+    func rethrowsTokenProviderError() async throws {
+        let middleware = BearerAuthMiddleware {
+            throw TokenError.expired
+        }
+
+        await #expect(throws: TokenError.expired) {
+            _ = try await middleware.intercept(
+                .get,
+                body: nil,
+                baseURL: .base,
+                operationID: "listApps",
+                next: { _, _, _ in
+                    Issue.record("The next handler should not be called when the token provider throws")
+
+                    return (HTTPResponse(status: .ok), nil)
+                }
+            )
+        }
+    }
+}
+
+// MARK: - Helpers
+
+/// An actor that returns a new token every time it is asked for one.
+private actor TokenSequence {
+    private var count = 0
+
+    func next() -> String {
+        count += 1
+
+        return "token-\(count)"
+    }
+}
+
+/// An error thrown by a token provider.
+private enum TokenError: Error {
+    case expired
 }
 
 // MARK: - HTTPRequest+Samples