Let orchestra_api and orchestra_client run without the Orchestra engine, moving server-only code to orchestra_server_api and the request limits and remote pages under Web services

Closes https://www.drupal.org/project/orchestra/issues/3631390

A site that only calls a remote Orchestra (for example one hosting the forms a workflow on another site collects) can now install orchestra_api and orchestra_client without the engine. Nothing those two modules hold is specific to the answering side.

One commit per step:

• Move LocalOrchestraClient and its contract binding to orchestra_server_api. orchestra_client's alter() still wins the binding on a peer site (engine + server API + client), and ClientBindingTest now orders orchestra_client before orchestra_server_api, the order in which a YAML alias would lose.
• Move AcceptedIdentitySchemes and IdentitySchemeResolverInterface to orchestra_server_api: service orchestra_server_api.accepted_identity_schemes, tag orchestra_server_api.identity_scheme_resolver.
• Move FloodGuard to orchestra_api (orchestra_api.flood_guard). Its switch and period move from orchestra.settings to orchestra_api.settings, and the Request limits section of the Orchestra settings form becomes its own page, Configuration > Web services > Orchestra request limits, with the permission administer orchestra request limits. orchestra_interaction now depends on orchestra_api.
• Drop orchestra:orchestra from orchestra_api. orchestra_client gets its own permission, administer orchestra remotes, and its pages move to Configuration > Web services (Remote Orchestras, Orchestra notices). Its kernel tests leave the engine out, and ClientSiteWithoutEngineTest installs it the way a site does and checks the engine stays out.

Deploying

• Run drush en orchestra_api before drush cr on any site with orchestra_interaction: it now depends on orchestra_api, and its services need orchestra_api.flood_guard.
• Request limits that were switched on in orchestra.settings are off again until switched on at the new page (no update hook before beta). The old keys stay behind as orphans: drush config:delete orchestra.settings flood removes them.
• Grant administer orchestra remotes and administer orchestra request limits to whoever administered them through administer orchestra.

Other projects

Kernel tests that enable orchestra_interaction must now enable orchestra_api too: 21 classes in yoyaku and 1 in pdv.

AI-Generated: Yes (Claude Code was used to help write the change, its tests and this description. I reviewed them, and the new tests were confirmed to fail when the engine dependency is put back or the form saves the wrong key.)