feat(preprod): Record client attribution on snapshot read endpoints

[mtopo27]

The three snapshot read endpoints now record an analytics client field that
classifies each caller as web, sentry-cli, or MCP (with client family, e.g.
mcp:cursor). This lets us see in analytics how much snapshot read traffic
comes from the MCP server and which client family, versus the web UI — the same
attribution issue.viewed already records.

• get_snapshot (.../snapshots/{id}/) — existing
  preprod_artifact.api.get_snapshot_details event gains a client field.
• get_snapshot_image (.../snapshots/{id}/images/{image}/) and
  get_latest_base_snapshot (.../snapshots/latest-base/) had no analytics;
  each now emits a new event recorded on the authorized-read path.

Classification reuses the existing resolve_action_source()
(sentry/issues/action_log), so the values match its scheme
(web / sentry-cli / mcp:<family> / api) rather than issue.viewed's
mcp - <family> format. No new helper, no change to the existing
issue.viewed call site.

New/changed event payloads:

Event	Fields
preprod_artifact.api.get_snapshot_details	+ client
preprod_artifact.api.get_snapshot_image (new)	org/project/user/artifact, image_identifier, client
preprod_artifact.api.get_latest_base_snapshot (new)	org/project/user/artifact, app_id, client

Scope note: this covers the MCP-tool read endpoints only. sentry-cli download
attribution is intentionally out of scope — the CLI hits a
.../snapshots/{id}/download/ route that does not exist in sentry or getsentry
today, so it needs that route built/aliased before it can be instrumented.
latest-base traffic from the CLI is already captured here (classified as
sentry-cli) once the CLI uses it.

Refs EME-1215

[linear-code]

EME-1215