feat: add opt-in @okta/okta-angular/client-js entry point

[BenjaminTruong-okta]

Summary

• Adds a new, fully opt-in @okta/okta-angular/client-js secondary entry point that wraps the beta @okta/okta-client-javascript SDK (@okta/auth-foundation + @okta/oauth2-flows + @okta/spa-platform) in Angular's native router primitives, as an alternative to the existing @okta/okta-auth-js-based guards.
• The API is built around Angular's dependency injector rather than factory functions: provideClientJsAuth({ orchestrator, fetchClient }) registers a consumer-constructed orchestrator/fetch client via the CLIENT_JS_ORCHESTRATOR/CLIENT_JS_FETCH_CLIENT injection tokens, and the directly-exported tokenGuard (CanActivateFn), loginCallbackGuard (CanActivateFn), and fetchResolver helper inject() those tokens at call time — mirroring the OKTA_AUTH/provideOktaAuth pattern this repo already uses for okta-auth-js, rather than porting okta-react's factory/closure shape. Per-route token params are read from route.data.clientJs.params, the same convention okta.guard.ts uses for route.data.okta.
• The three new SDK packages are declared as optional peer dependencies in lib/package.json. The default @okta/okta-angular entry point, and all existing okta-auth-js-based consumers, are completely unaffected.
• The boundary is enforced by lint, not just convention: lib/.eslintrc.json adds import/no-restricted-paths (blocks lib/src importing lib/client-js) and no-restricted-imports (blocks lib/src importing @okta/auth-foundation/@okta/oauth2-flows/@okta/spa-platform directly) — verified by deliberately introducing and reverting a bad import to confirm the rule actually fires.
• Packaging mechanics (the lib/client-js secondary entry point, optional peer deps, lint boundary) were informed by okta-react's feat/client-js-opt-in-support branch, but the guard/resolver/provider API itself was redesigned around idiomatic Angular DI rather than mirroring React Router's loader/factory structure, per review feedback that the initial pass leaned too heavily on the React SDK's shape.

Test plan

• yarn build — emits dist/client-js with a ./client-js entry in the root dist/package.json exports map
• yarn lint — confirmed the boundary rule fires on a deliberate bad import (then reverted), full suite passes clean
• yarn test:unit — 68/68 passing, 100% coverage on the new client-js files
• README: new "Using @okta/okta-angular/client-js (opt-in, beta)" section with install steps and a worked routing example

Not included in this pass (by design, per scoping discussion): sample-app wiring in test/apps/.