Add HTTP Basic auth as an alternative to OAuth

[adriankumpf]

Every endpoint accepts the account's email and password in an ordinary Authorization header, which sidesteps the token lifecycle entirely: nothing expires, there is no consumer to register, and neither of the per-IP rate limits on consumer_token and authorize applies. That is most of what Quirks of the API warns about, gone.

client = Discovergy.Client.new() |> Discovergy.Client.basic_auth(email, password)

Verified against meters, field_names, last_reading, readings, statistics, devices, disaggregation and activities, all 200. The 401 for a missing credential advertises the scheme itself, so this is not an accident of the routing layer:

www-authenticate: Basic realm="Discovergy", charset="UTF-8"

The API documents none of it, which is why this is an alternative to login/3 rather than a replacement. login/3 stays the documented way in, and everything the guide says about tokens still applies whenever it is used.

Nothing goes out when the client is built, so basic_auth/3 returns the client rather than {:ok, client}. A wrong password therefore surfaces on the first real request, as a 401 that says what is wrong:

401 Unauthorized: Invalid email or password supplied in the HTTP Authorization header

That body is the whole difference in error handling. An expired OAuth token is an empty-bodied 401 worth recovering from; a 401 here is a credential that will not start working on its own.

One auth field instead of two

:consumer and :token collapse into a single :credentials field holding either an OAuth session or the Basic auth pair. Only two of the four field combinations were ever legal, and the request path now dispatches on one value instead of picking its way through them. Client also stops knowing how either scheme builds a header: OAuth.authorization/4 and BasicAuth.authorization/1 do that themselves, both returning a lowercase header name to match the rest of the request.

credentials/1 reads the session back for persistence, which the struct being @opaque had previously left to reaching into documented fields:

- # persist client.consumer and client.token, then later:
- client = Discovergy.Client.new(consumer: consumer, token: token)
+ # persist Discovergy.Client.credentials(client), then later:
+ client = Discovergy.Client.new(credentials: credentials)

Reauthorizing a Basic auth client reports :not_logged_in, since there is no OAuth session to renew.

Verification

Both paths exercised live against the public demo account, plus an OAuth session serialized and restored into a fresh client.