Isolate session and token state per client

[jsachs]

Summary

Create a separate HTTP session and token set for each NerisApiClient instance.

Problem

_NerisApiClient defined both its requests.Session and TokenSet as class attributes. Python therefore created these objects once and shared them across every client instance in the same process.

This can cause one client’s authentication state to affect another. For example, an application that creates separate clients for two API integrations could have one client overwrite the shared Authorization header or refresh the shared access token. Subsequent requests from the other client could then be sent using the wrong credentials.

Fix

Initialize requests.Session and TokenSet in __init__ so each NerisApiClient instance owns its own HTTP headers, access token, refresh token, and expiration state.

Example

first = NerisApiClient(first_config)
second = NerisApiClient(second_config)

After this change, authentication performed by first does not add or replace the authorization header or token state used by second.

Tests

Added a regression test that creates two clients and verifies that they have distinct sessions and that authorization state from one client is not present on the other.