BReg problem fieldPath: typed clients and the immediate-action refusal

## Context

BReg problem responses may carry a `fieldPath` member, as the BReg API reference documents. The shared `ProblemDocument` in `registry-platform-httpsec` rejects unknown members, so a problem that carries `fieldPath` becomes a generic `problem_failure` in the Rust, Node and Python clients instead of a typed refusal. That is the case for immediate-action refusals and, since PR #850, for the missing `Idempotency-Key` refusal on the surfaces that use the header-specific helper. Typed clients always send the header, so they only meet the immediate-action case today.

## Work

- Let the shared problem document accept and expose `fieldPath`, following the owning product's contract (see `crates/CLIENTS.md`), and update the client reference sentence that describes the six-member document.
- Route the immediate-action missing `Idempotency-Key` refusal in `crates/registry-breg/src/api/actions.rs` through the same header-specific helper the other surfaces use, with a negative test, so server and clients move together.
- Check the `"fieldPath": null` example on the precondition problem in the BReg API reference: the server either emits the member or omits it, and the example must match.

## Origin

Review of PR #850; declined there because the clients own the change.

Start with the shared ProblemDocument and its contract in crates/CLIENTS.md, then inspect crates/registry-breg/src/api/actions.rs and the BReg API reference examples. Run the relevant client and server tests, add the named negative coverage for the immediate-action refusal, and confirm fieldPath is accepted and exposed while the documented null-or-omitted behavior matches the server.

Written by the indexing model from the issue text.