feat: browser experiments with auth-safe exposure tracking

[LiorMazig]

Summary

Adds base44.experiments for browser feature-flag reads, auth-aware readiness/subscriptions, and experiment exposure tracking. Draft pending platform integration and complete validation; no stable package release or dependency changes.

Intent (for reviewers & PR Autofix)

What this PR does

Adds SDK-owned local experiment evaluation for browsers/request-scoped Workers, common-auth reactivity, hydration snapshots and acknowledged exposure delivery. Live QA follow-ups preserve occurrence-time preview intent on goals and isolate server Analytics clients.

Key decisions & why

• Platform bootstrap/request context supplies public config; no per-decision config fetch or experiment-specific auth.me(). Browser user content waits for the same client's common auth.
• Snapshots do not track. React reports decisions after commit; Worker decisions await experiments.flush(). Stable event ID/time/auth survive bounded retries.
• Preview reads do not expose. Ordinary Analytics still records goals, adding the reserved JSON-string __b44_experiment_preview at track-time so platform results can exclude only the matching flag, including false/persisted overrides.
• Server Analytics queue, processor, session promise and fallback visitor ID are per-client. Existing browser sharing remains unchanged. Token/logout invalidation targets the owning server client's state.

What NOT to touch

Package version, dependencies and lockfiles are unchanged intentionally. The context header is not authentication: app ingress must strip/rebuild it. Preserve existing void/best-effort Analytics tracking rather than claiming durable delivery or adding a new public API.

Tradeoffs / follow-ups

Ten added regression cases cover preview capture and concurrent public Worker clients, including separate apps/users, cleanup/token-reset isolation and fallback identities. Focused local runs pass (59 experiment/auth tests; 22 analytics/client tests, overlapping). Local Vitest/dependency aliases differ from the lockfile; expanded collection/type checking remains dependency-blocked, so current-head locked CI is required.

The preceding head passed 355 locked unit/type tests and preview publishing; that is not new-head evidence. Matching platform preview-goal filtering and rebuilt SDK adoption must ship together. Stable release, live Worker/auth QA and delayed finalization remain rollout gates. Retries are memory-bound, not offline-durable or exactly-once.

Testing

• 39 focused tests passed: runtime reads/fallbacks, subscriptions/readiness, real auth integration, stale-response races, exposure payloads, auth pinning, deduplication, and analytics opt-out.
• Those local tests used available Vitest 2.1.9 / Axios 1.13.6, not the repository's locked Vitest 4.1.9 / Axios 1.18.1. Scoped TypeScript 5.9.3 validation and git diff --check passed.
• Locked npm ci is blocked by local registry/security access; offline cache is incomplete. Full unit/type tests, build, lint, and generated documentation remain unverified locally and require CI or restored dependency access.
• Public types and JSDoc/pipeline registration included; no package or lockfile changes.

[github-actions]

🚀 Package Preview Available!

---

Install this PR's preview build with npm:

npm i @base44-preview/sdk@0.8.48-pr.280.7eec9ba

Prefer not to change any import paths? Install using npm alias so your code still imports @base44/sdk:

npm i "@base44/sdk@npm:@base44-preview/sdk@0.8.48-pr.280.7eec9ba"

Or add it to your package.json dependencies:

{
  "dependencies": {
    "@base44/sdk": "npm:@base44-preview/sdk@0.8.48-pr.280.7eec9ba"
  }
}

• 📦 Preview Package: @base44-preview/sdk@0.8.48-pr.280.7eec9ba
• 🔗 View this commit on GitHub

---

_{Preview published to npm registry — try new features instantly!}

[LiorMazig]

CI verification update:

• Locked-dependency unit suite: 340 tests passed across 25 files, including the 39 new focused cases.
• Type tests, lint, and preview build/publish passed.
• Dependency audit did not complete: npm's audit endpoint returned HTTP 400 (retired quick endpoint / invalid request payload). This is an audit-service failure, not a reported vulnerability; no dependencies were changed.
• Generated docs remain unverified locally. The platform adoption and blocked-storage attribution follow-ups in the intent brief still apply before release.

Stable @base44/sdk was not published. The preview package is available in the CI bot's comment.