Implement Phase 9: client libraries (Go, Rust, Lisp, Python)

- clients/README.md: canonical API surface and error type reference
- clients/testdata/: shared JSON response fixtures
- clients/go/: mciasgoclient package; net/http + TLS 1.2+; sync.RWMutex
  token state; DisallowUnknownFields on all decoders; 25 tests pass
- clients/rust/: async mcias-client crate; reqwest+rustls (no OpenSSL);
  thiserror MciasError enum; Arc<RwLock> token state; 22+1 tests pass;
  cargo clippy -D warnings clean
- clients/lisp/: ASDF mcias-client; dexador HTTP, yason JSON; mcias-error
  condition hierarchy; Hunchentoot mock-dispatcher; 37 fiveam checks pass
  on SBCL 2.6.1; yason boolean normalisation in validate-token
- clients/python/: mcias_client package (Python 3.11+); httpx sync;
  py.typed; dataclasses; 32 pytest tests; mypy --strict + ruff clean
- test/mock/mockserver.go: in-memory mock server for Go client tests
- ARCHITECTURE.md §19: updated per-language notes to match implementation
- PROGRESS.md: Phase 9 marked complete
- .gitignore: exclude clients/rust/target/, python .venv, .pytest_cache,
  .fasl files
Security: token never logged or exposed in error messages in any library;
TLS enforced in all four languages; token stored under lock/mutex/RwLock

clients/README.md

@@ -0,0 +1,35 @@
+This directory contains client libraries for the MCIAS REST API.
+All language implementations expose this API:
+```
+Client(server_url, [ca_cert_path], [token])
+login(username, password, [totp_code]) → (token, expires_at)
+logout() → void
+renew_token() → (token, expires_at)
+validate_token(token) → {valid, sub, roles, expires_at}
+get_public_key() → {kty, crv, x}
+health() → void  # raises/errors on 5xx
+create_account(username, account_type, [password]) → account
+list_accounts() → [account]
+get_account(id) → account
+update_account(id, [status]) → account
+delete_account(id) → void
+get_roles(account_id) → [role]
+set_roles(account_id, roles) → void
+issue_service_token(account_id) → (token, expires_at)
+revoke_token(jti) → void
+get_pg_creds(account_id) → pg_creds
+set_pg_creds(account_id, host, port, database, username, password) → void
+```
+| Name | HTTP Status | Meaning |
+|---|---|---|
+| `MciasAuthError` | 401 | Token missing, invalid, or expired |
+| `MciasForbiddenError` | 403 | Insufficient role |
+| `MciasNotFoundError` | 404 | Resource does not exist |
+| `MciasInputError` | 400 | Malformed request |
+| `MciasConflictError` | 409 | Conflict (e.g. duplicate username) |
+| `MciasServerError` | 5xx | Unexpected server error |
+`testdata/` contains canonical JSON response fixtures shared across language tests.
+- `go/` — Go module `git.wntrmute.dev/kyle/mcias/clients/go`
+- `rust/` — Rust crate `mcias-client`
+- `lisp/` — ASDF system `mcias-client`
+- `python/` — Python package `mcias_client`