[sub-spm-optional-products] Add LCECryptoKit and LCFeatureControl as optional sub-SPM products

LCEssentials installs standalone; each sub target-depends on it so linking a
sub's product always pulls LCEssentials in too, without the consumer having to
declare it separately.

- LCECryptoKit: internalized from the remote LCECryptoKitBinary git dependency
  (embedded token URL removed) into a local binaryTarget vendoring
  Frameworks/LCECryptoKit.xcframework. LCECryptoKitManager moved out of
  LCEssentials core into its own LCECryptoKitManager target/product; the
  no-op fallback for when the binary wasn't linked is gone (breaking change
  for existing consumers, see decisions/2026-09-15-sub-spm-optional-products.md).
- LCFeatureControl: new product wrapping Atomenta's Feature Control API
  (flag evaluation with TTL cache + safe-degrade fallback to defaults,
  notifications inbox, batched exposure telemetry). 45 new tests.

Tests/LCFeatureControlTests/FeatureControlAuthTests.swift

@@ -0,0 +1,38 @@
+import XCTest
+@testable import LCFeatureControl
+
+final class FeatureControlAuthTests: XCTestCase {
+
+    func testBearerAuthAddsAuthorizationHeader() async {
+        let auth = FeatureControlBearerAuth { "jwt-123" }
+        var headers: [String: String] = [:]
+        await auth.authorize(&headers)
+        XCTAssertEqual(headers["Authorization"], "Bearer jwt-123")
+    }
+
+    func testBearerAuthAddsNoHeaderWhenTokenIsNil() async {
+        let auth = FeatureControlBearerAuth { nil }
+        var headers: [String: String] = [:]
+        await auth.authorize(&headers)
+        XCTAssertNil(headers["Authorization"])
+    }
+
+    func testHeaderAuthAddsExactHeadersOnly() async {
+        let auth = FeatureControlHeaderAuth(headers: ["X-BFF-Session": "abc"])
+        var headers: [String: String] = [:]
+        await auth.authorize(&headers)
+        XCTAssertEqual(headers, ["X-BFF-Session": "abc"])
+        XCTAssertNil(headers["Authorization"])
+    }
+
+    func testConfigurationDefaults() {
+        let config = FeatureControlConfiguration(baseURL: "https://api.example.com",
+                                                 environment: "production",
+                                                 auth: FeatureControlHeaderAuth(headers: [:]))
+        XCTAssertEqual(config.cacheTTL, 45)
+        XCTAssertEqual(config.requestTimeout, 3)
+        XCTAssertEqual(config.evaluatePath, "/api/feature-control/evaluate")
+        XCTAssertEqual(config.notificationsPath, "/api/feature-control/notifications")
+        XCTAssertEqual(config.telemetryPath, "/api/feature-control/telemetry/exposure")
+    }
+}