[AlphaBs]

Add a net10.0 target with source-generated JSON metadata and remove automatic session persistence from MojangAuth. Authentication now returns a session for the caller to manage; it no longer reads or writes mojang_auth.json. The netstandard2.0 target remains available.

Changes

• Generate JSON metadata for built-in request/response models and replace anonymous request payloads with typed DTOs.
• Require JsonTypeInfo in all JsonHttpContent constructors and serialize(). Remove metadata-free serialization overloads, the Create factory, and the associated trimming/dynamic-code warning attributes. Internal requests call the metadata-required constructors directly.
• Require JsonTypeInfo in JSON response/error/array handlers and supply generated metadata at every internal call site. Default response handling for built-in models also resolves only generated metadata.
• Use the same metadata-only JSON processing for netstandard2.0 and net10.0. Remove the reflection-based deserialization fallback, its options, and conditional compilation branches.
• Mark net10.0 as IsAotCompatible, use framework-provided dependencies, and update the netstandard2.0 System.Text.Json dependency to 10.0.14 to support the non-generic Serialize(object, JsonTypeInfo) API.
• Update ConfigureAwait.Fody to 3.4.1 and Fody to 6.9.3, retaining ContinueOnCapturedContext=false for both targets. Both packages are private build dependencies; redundant explicit ConfigureAwait calls are removed.
• Delete ICacheManager, JsonFileCacheManager, and SessionFileCacheManager, along with cache injection, automatic persistence, and cache-only serialization helpers.
• Generate a fresh client token for the two-argument Authenticate overload and return the server-provided client token in Session so callers can explicitly refresh and validate it.
• Resolve nullable contracts: delegate type-pattern matching, explicit rejection of null JSON results/elements, nullable default-error results, exception-only Mojang error handlers, and safe missing-texture/UUID fallback.
• Update the existing legacy authentication sample and API documentation for explicit session management. README is unchanged; no test projects or CI workflows are included.

API changes

JsonHttpContent now requires metadata: new JsonHttpContent(value, typeInfo), with optional encoding and media-type overloads. serialize(value, typeInfo) also requires metadata. This intentionally breaks metadata-free callers. JSON response/error/array handler factories also require JsonTypeInfo on both target frameworks.

The cache-manager constructor and parameterless TryAutoLogin(), Refresh(), Validate(), and Invalidate() are removed. Callers must pass their Session or tokens to the remaining overloads. TryAutoLogin(Session) remains available to validate and, when necessary, refresh a caller-provided session. The obsolete Xbox adapter also no longer persists sessions. GetDefaultErrorHandler() explicitly returns Task<T?>. JSON object/array handlers throw JsonException for null results/elements instead of returning null through non-nullable contracts.

Validation

• Rebuilt the library for netstandard2.0 and net10.0 with all warnings treated as errors: 0 warnings, 0 errors.
• Clean-published the temporary Windows x64 NativeAOT verification executable with all warnings treated as errors, JSON reflection disabled, and the entire library rooted for analysis: 0 compiler, trimming, or AOT warnings. The native executable passed.
• Ran the same offline verification against the netstandard2.0 assembly with JSON reflection disabled. Checks cover all metadata-required constructors, custom encoding/media type, null payloads, JSON object/array null rejection, primitive default handlers, nullable default results, generic/non-generic exception propagation, null/missing profile texture fallback, and explicit session authentication/refresh/validation.
• Fody weaving is retained for both targets, with no transitive Fody runtime dependency. The package contains both target assemblies.
• No live accounts or Minecraft services were used. Temporary verification files are excluded from the PR; no session files were created during authentication.