feat(devex): add a kotlin sdk module with a typed ledger client

[tiana-code]

E-09 DevEx #304 (F-09.2) - a Kotlin SDK module.

What

New :libs:sdk-kotlin, a hand-written typed client over the REST API (JDK HttpClient + Jackson only, no coupling to service modules):

• FincoreClient(baseUrl, token?, httpClient, mapper): listAccounts(page,size) -> Page, getAccount(id) -> Account.
• Bearer auth applied only when a token is set; 30s request timeout; non-2xx -> FincoreException(status); id path-segment URL-encoded; deserializer tolerates unknown fields (forward-compat for new server fields).
• SDK-owned DTOs Account/Page with type/status as String, so the SDK never breaks on a new ledger enum value.
• maven-publish configured with NO remote target (local consumption + POM only, like decision-engine F-05.8 Library mode artifact #175) - nothing is pushed to a registry (§0-safe).
• Embedding test: an in-process JDK HttpServer; covers list decode, bearer-sent, 404 -> FincoreException, and unknown-field tolerance.

Hand-written over openapi-generator: no codegen toolchain, fully reviewable, clean dependency footprint. Scope is a deliberate minimal first surface; #310 tracks the remaining read/write operations.

Evidence

./gradlew :libs:sdk-kotlin:build = BUILD SUCCESSFUL locally (detekt + spotlessCheck + 4 tests + jacoco).

Gate chain

• critic: GO - no remote publish target anywhere; Account/Page match the ledger DTOs field-by-field; endpoints verified vs AccountController; catalog aliases resolve so full CI == local; embedding test real; clean-room clean.
• security-auditor (opus): PASS - §0 no-publish confirmed, no hardcoded secrets (test-token is a fake fixture, bearer not logged), JDK TLS validates, SPDX on all files, 6/6 ACs.
• evaluator: PASS (0.91). Both optional LOWs (id-encode, FAIL_ON_UNKNOWN=false) applied.

Closes #304