feat(agent-memory): configure access_strategy and tenant at client level

- create_client() and AgentMemoryClient.__init__ accept access_strategy
  (default SUBSCRIBER_ONLY) and tenant as constructor params
- _resolve_tenant is now an instance method; per-call params override
  instance defaults
- All method signatures change to Optional[AccessStrategy] = None
  (sentinel: use instance default)
- user-guide: add client-level configuration section and PROVIDER_ONLY
  isolation warning
- tests: update TestAccessStrategy and TestCreateClient for instance method

Author: cassiofariasmachado

src/sap_cloud_sdk/agent_memory/__init__.py

@@ -5,9 +5,13 @@
 
 Usage::
 
-    from sap_cloud_sdk.agent_memory import create_client
+    from sap_cloud_sdk.agent_memory import create_client, AccessStrategy
 
-    client = create_client()
+    # Subscriber tenant — strategy and tenant set once, inherited by all calls
+    client = create_client(
+        access_strategy=AccessStrategy.SUBSCRIBER_ONLY,
+        tenant="my-tenant-subdomain",
+    )
     memories = client.list_memories(agent_id="my-agent", invoker_id="user-123")
 """
 
@@ -34,25 +38,41 @@
 from sap_cloud_sdk.agent_memory.utils._odata import FilterDefinition
 
 
-def create_client(*, config: Optional[AgentMemoryConfig] = None) -> AgentMemoryClient:
+def create_client(
+    *,
+    config: Optional[AgentMemoryConfig] = None,
+    access_strategy: AccessStrategy = AccessStrategy.SUBSCRIBER_ONLY,
+    tenant: Optional[str] = None,
+) -> AgentMemoryClient:
     """Create an :class:`AgentMemoryClient` with automatic credential detection.
 
     Args:
         config: Optional explicit configuration. If ``None``, credentials are
                 loaded from the mounted volume at
                 ``/etc/secrets/appfnd/hana-agent-memory/default/`` or from
                 ``CLOUD_SDK_CFG_AGENT_MEMORY_DEFAULT_*`` environment variables.
+        access_strategy: Default tenant access strategy for all client operations.
+                Defaults to ``SUBSCRIBER_ONLY``. Individual method calls may override
+                this value.
+        tenant: Default subscriber tenant subdomain. Required when
+                ``access_strategy=SUBSCRIBER_ONLY``. Individual method calls may
+                override this value.
 
     Returns:
         A ready-to-use :class:`AgentMemoryClient`.
 
     Raises:
-        AgentMemoryConfigError: If configuration is missing or invalid.
+        AgentMemoryConfigError: If configuration is missing, invalid, or
+            ``access_strategy=SUBSCRIBER_ONLY`` is used without a ``tenant``.
     """
     try:
         resolved_config = config if config is not None else _load_config_from_env()
         transport = HttpTransport(resolved_config)
-        return AgentMemoryClient(transport)
+        return AgentMemoryClient(
+            transport,
+            access_strategy=access_strategy,
+            tenant=tenant,
+        )
     except AgentMemoryConfigError:
         raise
     except Exception as exc: