feat(hypihub): identify requests with the distribution version

[rponeawa]

Every request to HypiHub now carries user-agent: hypit/<version>, where the version is the distribution's own npm version read from the root package.json. Before this, Node's undici default user-agent: node went out.

How

HypiHubClient wraps its injected fetcher once in the constructor. All API calls, OAuth token refreshes, multipart uploads and asset downloads run through client.fetcher, so one wrap covers them. activation.ts, index.ts, mapping.ts and routes.ts make no network calls.

The wrapper hands the underlying fetcher a plain header object, which is the shape the existing tests read.

Version lookup

../../../package.json resolves to the distribution root both in the repository and in an installed package, since npm ships packages/*/src/**/* at the same depth. The manifest's name must be @hypit/hypit for its version to be used; an absent, unreadable or foreign manifest yields hypit/unknown, and the read is guarded so the module still imports.

A checkout of main ahead of the last Release reports that Release's version, because the root package.json only advances when a version is committed for release.

Checks

A full generation driven through a recording fetch showed the header on all 12 requests:

hypit/0.1.8    https://hypit.ai/oauth/token          (3 refreshes)
hypit/0.1.8    https://hypit.ai/v1/files/uploads     (session, part signing, complete)
hypit/0.1.8    https://s3.example/p-1                (presigned PUT)
hypit/0.1.8    https://hypit.ai/v1/models/…
hypit/0.1.8    https://hypit.ai/v1/videos
hypit/0.1.8    https://hypit.ai/v1/jobs/job1         (poll, assets)
hypit/0.1.8    https://download.hypit.test/r.mp4

The same probe run from a layout whose manifest belongs to another package, and from one with no manifest at that depth, reported hypit/unknown.

node test/run.mjs: 854 tests, 844 pass, 10 skipped, 0 fail.

The presigned upload PUT goes to S3 and also carries the header. S3 presigned URLs verify only the headers listed in X-Amz-SignedHeaders, which does not include user-agent; that PUT succeeds in the probe above.