feat(client): support isolated RPC connections - #401

Background (Why)

An external viewer can open RPC connections to independent Devframe endpoints in one browser document. Shared connection discovery can reuse the first endpoint, while browser credential storage and the devframe-auth BroadcastChannel can overwrite another endpoint's remembered token. Explicit connection descriptors select an endpoint but still participate in this shared authentication state.

The authentication broadcast contains a token without a backend identifier. Applications that manage independent connections or their own credential persistence need an explicit way to opt out of this shared state.

Changes (What)

Add isolated?: boolean to DevframeConnection. An isolated connection skips shared connection discovery, credential storage and authentication broadcasts. Token and one-time-code authentication still use its own RPC transport and update the retained descriptor. Omitting the flag or using false preserves existing shared behavior.

Setup accepts either a complete connection or DevframeConnectionDiscoveryOptions before metadata has been resolved:

const connection = await setupDevframeConnection({
  baseURL: 'http://localhost:5173/',
  connection: { isolated: true },
})
const rpc = await connectDevframe({ connection })

The named discovery type also accepts shared mode, so it does not imply an already resolved, isolated connection. Reusing a prepared descriptor preserves its isolation setting. JSDoc on the flag, discovery type and channel guard explains why unscoped authentication broadcasts are skipped.

Verification (Testing)

All 48 tests in the six affected connection/authentication files pass. They cover shared defaults, token precedence for provided and fetched metadata, independent token updates, descriptor reuse and transport disposal. Browser storage and transport I/O are mocked at their existing boundaries.

All 92 Devframe API snapshot checks pass locally on the PR branch. The extracted input type is assignable to and from the previous inline shape. Package build, typecheck and changed-file ESLint pass. Full monorepo validation runs in PR CI.

The current merge-check CI reports three diagnostics declaration snapshot mismatches. The same three mismatches occur on upstream main 9aa752a1, which is the upstream commit used by the PR merge check. The changed client snapshot passes; these diagnostics snapshots are outside this connection-isolation change.