feat!: add client profiles, captcha policies, client search, and dynamic CIMD settings (#898)

Adds client profiles, CAPTCHA policies, client and client grant search,
and dynamic CIMD support to the Management API client, and exposes every
generated resource on `ManagementClient`.

### Breaking Changes ⚠️

The breaking changes are limited to the experimentation APIs, one field
on organization search results, a connection model that no endpoint
returns, and one error mapping.

- **Experiments and feature flags**: `experiments.update_status()` and
`feature_flags.update_status()` are removed. A separate status endpoint
is no longer needed, because the status is now set through the update
request: `client.experimentation.experiments.update(id, status=...)` and
`client.experimentation.feature_flags.update(id, status=...)`.
- **SearchOrganization**: the `metadata` field is removed.
- **ConnectionResponseCommon**: now declares its own fields instead of
extending `CreateConnectionCommon`, and `display_name` is required. No
endpoint returns this model, so no client call is affected.
- **Feature flag variations**: `variations.delete()` no longer maps HTTP
400 to `BadRequestError`, so a 400 raises the base `ApiError`. Code that
catches `ApiError` is unaffected.

### Added

- **Full resource access on `ManagementClient`**: every Management API
resource is now available on the client, including `agents`,
`client_profiles`, `connection_profiles`, `events`, `experimentation`,
`groups`, `rate_limit_policies`, `risk_assessments`, and
`user_attribute_profiles`.
- **Client Profiles**: define a configuration that applies automatically
to every client matching a rule, and manage it through
`client.client_profiles`.
- **CAPTCHA Policies**: create and manage CAPTCHA policies through
`client.attack_protection.captcha_policies`.
- **Search for clients and client grants**: find applications and grants
with `client.clients.search()` and `client.client_grants.search()`, with
pagination and sorting.
- **Dynamic CIMD registration**: turn on dynamic registration for Client
ID Metadata Document clients in tenant settings, and see each client's
metadata status.
- **New settings**:
- Clients: `enforce_anon_session_transfer_network_binding` and
`oidc_support`
  - Tenant settings: `dpop_strict_refresh_token_binding`
  - Brute force protection: `form_submission_mode`
  - Experiments, feature flags, and segments: `status`
- **Smaller additions**: Google Workspace provisioning and directory
sync on connection profiles, an organization member access level on
organization connection events, and the passkey Guardian factor.

### Changed

- **CIMD Registration**: `client.clients.register_cimd_client()` raises
`ConflictError` on HTTP 409 instead of `ApiError`. `ConflictError`
subclasses `ApiError`, so existing handlers still catch it.
- **Roles**: `owner_id` on the `roles.list()` filter is typed as
`RoleOwnerIdFilter`, and `owner_id` on the role response types as
`RoleOwnerId`, with `SystemRoleOwnerId` added. All three are string
aliases, so existing code is unaffected.
- **Event stream cloud events**: `a0stream` is now optional on the
connection, group, organization, and user cloud event types. It is
omitted when events are retrieved through the Events API.

### Removed

- `experiments.update_status()` and
`UpdateExperimentStatusResponseContent`. Use `experiments.update(id,
status=...)`.
- `feature_flags.update_status()` and
`UpdateFeatureFlagStatusResponseContent`. Use `feature_flags.update(id,
status=...)`.
- `SearchOrganization.metadata`.

Author: rmad17

.fern/replay.lock

@@ -6,5 +6,11 @@ generations:
     timestamp: 2026-10-14T09:56:56.826Z
     cli_version: unknown
     generator_versions: {}
-current_generation: 98090cdf6841619f7a558af87f0cd7612d11fdff
+  - commit_sha: ca6941ebe04b306e94f3315865d5fd06e3b2f233
+    tree_hash: b718a95d426e320124dc2cd54ef4bdb0a0623ac8
+    timestamp: 2026-10-14T10:04:24.137Z
+    cli_version: unknown
+    generator_versions:
+      fernapi/fern-python-sdk: 5.26.0
+current_generation: ca6941ebe04b306e94f3315865d5fd06e3b2f233
 patches: []

.fernignore

@@ -10,6 +10,7 @@ tests/management/
 
 # Documentation
 v5_MIGRATION_GUIDE.md
+UPGRADING.md
 CHANGELOG.md
 
 # Authentication API (copied from auth0-python, not Fern-generated)