Add liveness sessions for API contract 2.0.0

[imronreviady]

createLivenessSession (named in each language's style) starts a session
and returns its ID, the challenges to show in order and the expiry.
completeLivenessSession submits the frames with mirrored and returns
isLive, the steps and, when the session passed, the liveness token used
for enrolment. LIVENESS_SESSION_INVALID surfaces as the typed API error.

Completion is retried only on 429: any other answer, 503 included, means
the session was already used up, so a retry could only fail.

BREAKING: activeLiveness results no longer carry the token fields,
because the API stopped returning them. This is a new major version,
pinned to contract 2.0.0, with migration notes in the CHANGELOG.

Verification

• Each SDK's test suite passes (mocked HTTP: create returns challenges, complete parses steps and token, 422 surfaces as the typed error, completion retried only on 429), and the contract test pins 2.0.0.

Part of the liveness-challenges change (backend, engine, console and the five SDKs ship together).