Refactor api access lifecycle helpers

[tkilias]

What changed

This PR applies the structural api_access.py refactor on top of PR 3.

It includes:

• the _api_access internal package split
• the slim exasol/saas/client/api_access.py facade
• the allowed-IP cleanup that accompanies the refactor
• the unit-test updates needed for the new patch targets and structure

Why it changed

The previous PRs establish the final behavior. This PR keeps that behavior while reorganizing the implementation into smaller internal modules so the lifecycle helpers are easier to reason about and maintain.

Impact

There should be no intended user-facing behavior change relative to PR 3. The impact is internal structure and maintainability.

Validation

• poetry run pytest -q test/unit/test_api_access.py test/unit/test_ensure_type.py
• poetry run nox -s format:check
• poetry run nox -s lint:typing

[sonarqubecloud]

Quality Gate failed

Failed conditions
2 New Code Smells (required ≤ 0)

See analysis details on SonarQube Cloud

Catch issues before they fail your Quality Gate with our IDE extension SonarQube for IDE

[ahsimb]

InternalError is defined in errors.py but is not imported here and is absent from __all__. It was importable from exasol.saas.client.api_access before this PR (it was defined at module level). After this PR, from exasol.saas.client.api_access import InternalError will raise ImportError.

Every peer exception class (DatabaseDeleteError, DatabaseDeleteTimeout, DatabaseStartupFailure, OpenApiError) is re-exported — the omission looks unintentional.

Fix: add InternalError to the import block and to __all__.

[ahsimb]

This return True is unreachable dead code.

The guard at line 184 (if database_id not in visible_database_ids: return True) already exits when the DB is gone. Reaching line 191 means database_id is definitionally still in visible_database_ids, so the if database_id in visible_database_ids: condition on line 191 is always True — it unconditionally raises TryAgain. Control never falls through to return True on line 195.

Simplification:

if resp.status in in_progress:
    LOG.info("- Database deletion status: %s ...", resp.status)
    raise TryAgain

# database_id is still listed and status is not in_progress — keep retrying
LOG.info("- Database deletion status: %s ...", resp.status)
raise TryAgain

[ahsimb]

_log_api_output has a leading underscore (conventionally "do not import this") but is listed in __all__ (conventionally "this is the public API"). The two signals contradict each other and lock an internal helper into the public contract.

The old code had the function at module level but without an __all__, so the PR actually makes this exposure more explicit than before.

Pick one: either drop the underscore (log_api_output) if it is intentionally public, or remove it from __all__ (and from the facade) if it is an internal helper.