feat: add guest auth (device create-or-resume + upgrade)

[Taure]

Adds anonymous guest auth to the Unity SDK, mirroring the existing auth methods in AsobiAuth.

What

• GuestAsync(string deviceId, string deviceSecret) -> POST /api/v1/auth/guest (no auth header). Create-or-resume a guest from a device id + caller-supplied device secret (base64 of >= 32 CSPRNG bytes). Stores tokens exactly like LoginAsync/OAuthAsync.
• UpgradeGuestAsync(string username, string password) -> POST /api/v1/auth/guest/upgrade (Bearer, current access token). Claims a permanent account; replaces the stored token pair with the upgraded one.
• New request models GuestRequest (device_id, device_secret) and GuestUpgradeRequest (username, password).
• AuthResponse gains created, guest, upgraded flags (absent -> false for register/login) so callers can inspect create-vs-resume-vs-upgrade. Return type stays Task<AuthResponse>.
• Error handling is unchanged: the shared HttpClient raises AsobiException carrying the backend {"error":"<code>"} and HTTP status, same as every other auth call, so all documented guest/upgrade error codes surface through the existing path.

Scope note

The caller owns device-secret generation and persistence; the SDK passes it through and builds no secret-gen/storage helpers.

Tests + docs

• Tests/Runtime/AuthGuestTests.cs (EditMode): pins the JSON wire contract - request field names and response flag mapping (create / resume / upgrade). The endpoints are exercised end-to-end against a live backend by the existing SmokeTest.
• README: new "Guest / anonymous auth" subsection (OS-agnostic) plus a features-list line.

Local validation

Unity/IL2CPP can't build headless in this environment. Runtime/Models/AuthModels.cs compiles clean under dotnet (net8.0). The two new AsobiAuth methods are line-for-line parallel to LoginAsync. CI validates the full Unity build + PlayMode smoke.