feat: add Auth0-Client telemetry header

[kishore7snehil]

Changes

• Add Telemetry class (telemetry.py) that builds and caches the Auth0-Client header - a base64-encoded JSON payload with SDK name, version, and Python runtime environment
• Add _get_http_client() helper to ServerClient, MyAccountClient, and MfaClient to inject telemetry headers into all httpx requests (17 call sites)
• Pass telemetry headers to AsyncOAuth2Client for token exchange calls
• Add unit tests for telemetry header format and integration

[arpit-jn]

LGTM

[nandan-bhat]

The headers are built lazily here, but get_headers() is only ever called once in ServerClient.__init__, where the result is immediately stored in _telemetry_headers. The cache in Telemetry is never needed.

You can directly assign it like this and use in _telemetry_headers

  def __init__(self, name, version, env=None):
      self.name = name                                                                                                                              
      self.version = version                                                                                                                        
      self.env = env if env is not None else {"python": platform.python_version()}                                                                  
      payload = {"name": self.name, "version": self.version, "env": self.env}                                                                       
      self.headers = {                   # ← built once, right here                                                                                 
          "Auth0-Client": base64.b64encode(json.dumps(payload).encode()).decode(),                                                                  
          "User-Agent": f"Python/{platform.python_version()}",                                                                                      
      }  

[nandan-bhat]

This test patches _get_http_client and asserts it was called once but it doesn't verify the headers on the HTTP request. The test name is test_fetch_oidc_metadata_sends_telemetry, but it only checks that _get_http_client was invoked, not that telemetry headers were actually present.

Can we assert the header values here to match the test name ?

[nandan-bhat]

There are good tests for the _get_http_client path, but no test covering complete_interactive_login which is the only place
self._oauth.fetch_token(...) is called. That code path goes through Authlib's AsyncOAuth2Client, not through _get_http_client, so it's a different code path entirely.

Can we add a test that verifies telemetry headers are sent during the authorization code exchange ?

The base branch was changed.