Validate client-level projectId in the TS and Python clients

[AndreLFSMartins]

Per-session projectId is validated against ^prj_[A-Za-z0-9]{16}$ (Zod schema in types.ts), but the client-level projectId was passed straight to the x-codespar-project header with no validation — in both the TS and Python clients. A malformed client-level scope reached the backend instead of failing fast at construction.

• TS: extracts PROJECT_ID_REGEX in types.ts (now reused by the Zod schema and the CodeSpar constructor).
• Python: adds the matching _PROJECT_ID_RE check to AsyncCodeSpar.__init__ (covers the sync client via its factory).
• Fixes three Python test fixtures in test_session.py that used 17-char ids (never validated before).

Behavior change: a client constructed with a malformed projectId now throws at construction. Tests added (TS + Python).

npm test + tsc --noEmit green for packages/core; pytest + mypy + ruff green for packages/python.

Note: touches packages/core/src/index.ts, which also changes in #37 — a trivial merge conflict on the constructor is expected if both land; whichever merges second rebases.

[rapguit]

Going to rebase this on top of current main myself — the conflicts are purely additive (overlap with #36 / #37 in the constructor + test file, and with #54's MockValueSchema / os import), no design decisions involved, and you flagged the rebase ownership in the PR body. Will force-push to your branch shortly and then run the suites again before merging. Thanks for the heads-up note.

[rapguit]

Rebased and force-pushed to your branch — your commit (6c8c002) is preserved with original authorship, just replayed on top of post-#36 / post-#37 main. Resolutions were the additive kind we discussed:

• index.ts: kept the csk_ constructor check from Validate the csk_ API key prefix in the TS client #37 + your projectId check, in that order.
• __tests__/codespar.test.ts: kept all 5 tests (2 from Validate the csk_ API key prefix in the TS client #37 + your 3).
• types.ts: kept MockValueSchema from feat(sdk): hosted test-mode SDK surface — mocks forwarding, structured errors, tool-result guards, OSS test-parity seam #54 alongside your PROJECT_ID_REGEX const, and combined both fields on SessionConfigSchema (regex via const + mocks).
• _async_client.py: kept both import os and import re.

Verified locally:

• TS suite: 98/98 pass, tsc --noEmit clean.
• Python: re-running via CI on this push (my local doesn't have python3-venv handy); your PR body already states pytest + mypy + ruff green, and the CI workflow guards a regression.

Squash-merging once the workflows come back green. Thanks!