Adds a type-level utility for extending a std::variant with additional
alternative types without repeating the original type list. This enables
composing variant types where a superset variant needs all alternatives
from a base variant plus extras.

Splits the auth resource type into `route_resource` (route registration
time) and `resource` (authorization time). The new
`context_prefix_subject` variant in `route_resource` qualifies the
subject with the {context} path param before the ACL check runs, then
resolves to `context_subject`.

This ensures a user with ACLs on "foo" (default context) cannot access
:.staging:foo via the /contexts/.staging/subjects/foo/... URL.

Registers 15 context-prefixed routes that have a {subject} path
parameter. Each route extracts the context from the URL prefix,
scopes the subject with it via scope_subject_param(), and
delegates to the existing handler.

Covers: subject CRUD, versions, compatibility, config/{subject}, and
mode/{subject} — all via /contexts/{context}/... URLs.

Includes unit tests for scope_subject_param() and ducktape coverage
for all 15 endpoints and ACL isolation.

Registers 4 context-prefixed routes for /schemas/ids/{id} and its
sub-resources (/schema, /versions, /subjects). Adds a
scope_subject_query helper that injects the context as a "subject"
query parameter, scoping schema lookups to the specified context.

Includes unit tests for scope_subject_query and ducktape coverage
for schema lookup and sub-resource queries.

Adds scope_subject_prefix_query(), which injects or prepends the
normalized context into the subjectPrefix query parameter. The
context-prefixed GET /contexts/{context}/subjects route uses this
helper to scope subject listings to the specified context.

Includes unit tests for scope_subject_prefix_query and ducktape
coverage verifying subject isolation across contexts.

Registers context-prefixed routes for context-level config/mode and
schema types:

  - GET/PUT/DELETE /contexts/{context}/config
  - GET/PUT/DELETE /contexts/{context}/mode
  - GET /contexts/{context}/schemas/types (pass-through)

Adds inject_context_as_subject(), which sets the subject path
parameter to a context-only qualified subject (e.g., ":.staging:").
The config and mode wrappers use this to delegate to the existing
config/mode subject handlers. Schema types are global so the context
is accepted for compatibility but ignored.

Includes unit tests for inject_context_as_subject and ducktape
coverage for all operations.

While implementing context-prefixed route handlers, noticed that
DELETE /contexts/{context} was not normalizing the context path
parameter before the default-context check.

Apply normalize_context() to the context path parameter before the
default-context check. This ensures alias forms like "staging",
":.staging:", and ".staging" all resolve to the same canonical context
for deletion.

Includes ducktape coverage cycling through alias forms.

A serde client configured with schema.registry.url pointing to
/contexts/.serde performs a full produce/consume round-trip. Verifies
schemas are registered in the target context and isolated from the
default context.

Parametrized across Python, Go, and Java clients to cover all
language ecosystems.