Add anonymous auth support to v2 client SDK and migrate webserver to v2

The v2 client SDK (client/v2/) lacks anonymous request support, so the webserver cannot use v2 for calling anonymous endpoints like /auth/update-password-no-auth.

Current state:

- v2 AuthStrategy only has HMACAuth — _request() always calls _sign()

- v1 SDK uses _put_secure_body() which performs unnecessary encryption for HTTP environments (legacy pattern)

- webserver currently uses v1 APISession

Resolution plan:

1. Add AnonymousAuth strategy to v2 SDK (skip signing)

2. Migrate webserver auth-related handlers to v2 AuthClient

3. Remove v1 _put_secure_body legacy pattern

JIRA Issue: BA-4758