feat: add plans and masking policy clients

[AminChirazi]

Two of the gaps between this SDK and the API. The package tracks the newest primitives well - sets and keymaps are both current - but had nothing for Plans or masking policies, which are the governed path the product now leads with.

client.plans.get_plans()
client.masking_policies.create_masking_policy(
    name="pii", fields=rules, reversible=True, key_map_name="pii-reversal"
)

Client	Methods
client.plans	get_plans get_plan update_plan delete_plan
client.masking_policies	get_masking_policies get_masking_policy create_masking_policy update_masking_policy delete_masking_policy

Both mirror the shapes in the API's OpenAPI document (automators-com/datamaker#2879), and the method names match the resource clients already here.

Two behaviours documented rather than smoothed over

• delete_plan answers {"success": true}, not the {"message": ...} every other resource returns. Returned as-is. Normalising the wire shape is the API's decision, and an SDK that hides the difference makes the eventual fix harder to reason about.
• create_masking_policy sends only what the caller set, so the API applies its own defaults for consistent and reversible. Sending explicit nulls would override them - a subtle way to get non-consistent masking without asking for it.

The docstring for reversible also spells out that it only means anything alongside key_map_name, since that pairing is easy to miss.

Deliberately absent

The plan run endpoints (/plans/{id}/run, /runs, /signoffs). They carry artifacts, logs and multi-step state that the API does not yet describe in its spec, and guessing their shape is how an SDK ends up confidently wrong.

Verification

• 69 tests pass, 24 skipped - unchanged from before.
• ruff check --select F,E9 clean on both new modules; ruff format --check reports them already formatted. The remaining default-ruleset complaints are UP006/UP045 pyupgrade suggestions that the entire package shares (sets.py has the same 23), so the new files match house style rather than diverging from it.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.