…nts [v8] (#1440)

## Summary

Adds a `createWorkOS()` factory function that provides **compile-time
type safety** for public vs confidential clients.

When the SDK is instantiated with only a `clientId` (no API key), most
methods throw `ApiKeyRequiredException` at runtime. However, TypeScript
can't warn you at compile time because the `WorkOS` class type is
static—all methods appear available regardless of how it was
constructed.

The factory solves this by using function overloads that return
different types based on input:

- `createWorkOS({ clientId })` → returns `PublicWorkOS` (narrow type
exposing only PKCE-compatible methods)
- `createWorkOS({ apiKey, ... })` → returns full `WorkOS` type

## Example

```typescript
import { createWorkOS } from '@workos-inc/node';

// Public client (Electron, mobile, CLI) - only PKCE methods available
const publicClient = createWorkOS({ clientId: 'client_123' });

// ✅ These work - available on PublicWorkOS
const { url, codeVerifier } = await publicClient.userManagement.getAuthorizationUrlWithPKCE({
  provider: 'authkit',
  redirectUri: 'myapp://callback',
});

const auth = await publicClient.userManagement.authenticateWithCodeAndVerifier({
  code: authCode,
  codeVerifier,
});

// ❌ TypeScript error - not available on PublicWorkOS
publicClient.userManagement.listUsers();
publicClient.organizations.list();

// Confidential client (server) - full access
const serverClient = createWorkOS({
  apiKey: process.env.WORKOS_API_KEY!,
  clientId: 'client_123',
});

// ✅ All methods available
await serverClient.userManagement.listUsers();
await serverClient.organizations.list();
```

## Design

- **No runtime changes** - The factory returns a standard `WorkOS`
instance; type narrowing is purely compile-time
- **Uses `Pick<>` for maintainability** - Public method names are listed
once as a string union; types are derived automatically
- **Ignores env vars** - Factory uses only explicit input for
predictable types. Users who want env var convenience can use `new
WorkOS()` or pass `process.env.WORKOS_API_KEY` explicitly
- **Backward compatible** - `new WorkOS()` continues to work unchanged

…nts [v8] (#1440)

## Summary

Adds a `createWorkOS()` factory function that provides **compile-time
type safety** for public vs confidential clients.

When the SDK is instantiated with only a `clientId` (no API key), most
methods throw `ApiKeyRequiredException` at runtime. However, TypeScript
can't warn you at compile time because the `WorkOS` class type is
static—all methods appear available regardless of how it was
constructed.

The factory solves this by using function overloads that return
different types based on input:

- `createWorkOS({ clientId })` → returns `PublicWorkOS` (narrow type
exposing only PKCE-compatible methods)
- `createWorkOS({ apiKey, ... })` → returns full `WorkOS` type

## Example

```typescript
import { createWorkOS } from '@workos-inc/node';

// Public client (Electron, mobile, CLI) - only PKCE methods available
const publicClient = createWorkOS({ clientId: 'client_123' });

// ✅ These work - available on PublicWorkOS
const { url, codeVerifier } = await publicClient.userManagement.getAuthorizationUrlWithPKCE({
  provider: 'authkit',
  redirectUri: 'myapp://callback',
});

const auth = await publicClient.userManagement.authenticateWithCodeAndVerifier({
  code: authCode,
  codeVerifier,
});

// ❌ TypeScript error - not available on PublicWorkOS
publicClient.userManagement.listUsers();
publicClient.organizations.list();

// Confidential client (server) - full access
const serverClient = createWorkOS({
  apiKey: process.env.WORKOS_API_KEY!,
  clientId: 'client_123',
});

// ✅ All methods available
await serverClient.userManagement.listUsers();
await serverClient.organizations.list();
```

## Design

- **No runtime changes** - The factory returns a standard `WorkOS`
instance; type narrowing is purely compile-time
- **Uses `Pick<>` for maintainability** - Public method names are listed
once as a string union; types are derived automatically
- **Ignores env vars** - Factory uses only explicit input for
predictable types. Users who want env var convenience can use `new
WorkOS()` or pass `process.env.WORKOS_API_KEY` explicitly
- **Backward compatible** - `new WorkOS()` continues to work unchanged