Clojure wrapper for the Google Cloud Channel API (v1).

Provides idiomatic Clojure functions for the reseller-side surface of
Workspace + Cloud subscriptions: enumerating downstream customers, their
entitlements, the catalog (products, SKUs, offers), and four
tenant-migration writes (transferEntitlements, transferEntitlementsToGoogle,
import-customer, provision-cloud-identity).

Auth: use csl/scoped-delegated-credentials with the appropriate scope and
a reseller-admin impersonation target:
- CloudchannelScopes/APPS_ORDER   (read + write — see SCOPE NOTE below)

Cloud Channel API is reseller-only. The `apps.order` scope is granted by
Google only to authorized Workspace/Cloud resellers; non-reseller orgs
receive 403 on every call.

All list functions return {:data [...] :next-page-token "..."}.
:next-page-token is absent when there are no further pages.

SCOPE NOTE
`apps.order` is the only meaningful scope for production reseller work;
Google did not carve out a `.readonly` variant (the unrelated
`apps.reports.usage.readonly` scope covers only the deprecated
reports/reportJobs resources, which this wrapper does NOT expose).
This wrapper exposes ~24 reads plus four tenant-migration writes.
Entitlement-lifecycle writes (activate / cancel / suspend / changeOffer /
etc.), CRUD on customers / channelPartnerLinks, and repricing configs are
intentionally NOT wrapped; a future consumer files its own FR.

ACCOUNT vs CUSTOMER (terminology)
In Cloud Channel, an "account" is the reseller's own account
(e.g. "accounts/A012345"); a "customer" is a downstream Workspace
tenant the reseller manages (e.g. "accounts/A012345/customers/C987").
This is different from Directory's User/customer terminology.

All functions return {:data ...} on success or {:error ...} on failure.