docs: deprecate request options the API ignores (#98)

## Summary

Three request options are sent to the API, which never reads them:

- **`refresh` on assess.** The API stopped reading it when assessment
scoring was removed; every assess is evaluated live.
- **`address` and `operator_token` on session create.** `POST
/v1/sessions` reads only `context`, `product_name` and `kind`, so a
session is never pre-associated with a wallet or a credential. The
README examples presented this as a way to "refresh KYC for an existing
operator credential", which does nothing.

These options are now marked deprecated with the reason, and the README
pre-association examples are gone; the `kind: "sign_in"` example stays.
Nothing is removed and no signature changes, so existing callers keep
compiling. pay's `--refresh` help text says the same. Found in a docs
audit by comparing what each SDK sends with what the API route reads.

## Type of change

- [ ] Bug fix (no breaking change)
- [ ] New feature (no breaking change)
- [ ] Breaking change (existing callers must update)
- [x] Docs, tests, or internal maintenance only

## Public API

None removed. The options gain a deprecation note (`@deprecated` in
TypeScript, a docstring line in Python, help text in pay). No release is
cut for this alone.

## Test plan

Lint, type check and the full test suite pass locally in each repo.

## Checklist

- [x] Tests cover the new behavior, and the suite passes locally (no
behavior changed)
- [x] Lint, format, and type checks pass
- [x] Docs and README examples updated if the public surface changed
- [x] No secrets, credentials, or personal data in the diff or the tests

Author: vvillait88

README.md

@@ -64,11 +64,8 @@ if (status.status === "verified") {
   console.log(status.operator_token); // "opc_...", use for future requests
 }
 
-// Optional pre-association: attach the session to a known wallet or refresh KYC
-// for an existing operator credential.
-await client.createSession({ address: "0x..." });
-await client.createSession({ operator_token: "opc_..." }); // KYC refresh
-await client.createSession({ kind: "sign_in" }); // registration-only: account sign-in, no identity documents
+// Registration-only session: the buyer signs in with an AgentScore account, no identity documents.
+await client.createSession({ kind: "sign_in" });
 ```
 
 ### Wallet resolution

src/types.ts

@@ -67,6 +67,7 @@ export interface SignerMatch {
 export interface AssessRequest {
   address: string;
   chain?: string;
+  /** @deprecated The API ignores this field; every assess is evaluated live. */
   refresh?: boolean;
   policy?: DecisionPolicy;
   /** Optional server-side signer verdicts (wallet-binding + OFAC SDN). See {@link Signer}. */
@@ -421,6 +422,7 @@ export type AipAssessOptions =
 
 export type AssessOptions = {
   chain?: string;
+  /** @deprecated The API ignores this field; every assess is evaluated live. */
   refresh?: boolean;
   policy?: DecisionPolicy;
   operatorToken?: string;
@@ -433,9 +435,9 @@ export type AssessOptions = {
 export interface SessionCreateOptions {
   context?: string;
   product_name?: string;
-  /** Pre-associate the session with a known wallet (EVM `0x...` or Solana base58). */
+  /** @deprecated The API ignores this field; a session is not pre-associated with a wallet. */
   address?: string;
-  /** Pre-associate the session with an existing operator credential: e.g. refresh KYC for an `opc_...`. */
+  /** @deprecated The API ignores this field; a session is not pre-associated with a credential. */
   operator_token?: string;
   /** Session kind. `'kyc'` (the default) runs identity verification; `'sign_in'` is
    *  registration-only (the buyer signs in with an AgentScore account, no identity documents)