fix: restore API TLS verification

[shameondev]

Outcome

Restores Apple platform trust-chain and hostname validation for the primary SDK API client and the NoCodes network provider. The previous delegates accepted any server trust.

Changes

• delegate every authentication challenge to URLSession default handling
• remove the temporary staging trust bypass from both network stacks
• add an API-client regression test that requires default system handling and no synthesized credential

Verification

• git diff --check
• no remaining credentialForTrust or URLCredential trust bypass in Sources
• the focused XCTest is included; local execution is unavailable because this host has only Command Line Tools, so CI is the executable evidence

This is independent from the Remote Config targeting rollout and should be released as a security prerequisite.