p1: /v2/scrape, /v1/fetch, auth, CLI, contract tests

Single Fetcher.Fetch on the Guard that holds DenyPrefixes. skipTlsVerification
is ignored. No 502. keys add writes the secret only to --out. Release binary
has no -test-allow-prefix.

Makefile

@@ -24,9 +24,13 @@ lint:
 	$(GO) vet ./...
 	@if [ -n "$(STATICCHECK)" ]; then $(STATICCHECK) ./...; else echo "staticcheck not found; skipped"; fi
 
-# Hermes 0.19/0.21 parser harness lands in P1.
+# Hermes 0.19/0.21 SDK harness (firecrawl-py==4.17.0) against a local sifttest binary.
 contract:
-	@echo "P0: no contract tests yet"
+	$(GO) test -count=1 ./internal/api ./internal/auth ./internal/guard
+	@if command -v python3 >/dev/null 2>&1; then \
+	  $(GO) build -tags sifttest -trimpath -ldflags "$(LDFLAGS)" -o bin/sift-test ./cmd/sift && \
+	  python3 tests/contract/sdk_test.py; \
+	else echo "python3 not found; SDK contract skipped"; fi
 
 install: build
 	install -d $(DESTDIR)$(PREFIX)/bin