Adds scripts/integration_smoke.py for local validation against the
live socialapis.io REST API. The script makes one call per major
endpoint category (Facebook pages/groups/search/ads/marketplace,
Instagram profile/posts/search/reels, Account usage, plus two
error-mapping checks) and reports per-method pass/fail.

Why a script instead of CI tests:
- Real API tests need a token, which means either a secret in CI
  (leak surface) or manual-trigger workflows (low ROI)
- The mocked tests already cover wire-level behavior in CI
- A local smoke test catches the bugs mocks can't: wrong endpoint
  paths, Pydantic field name mismatches, envelope shape drift
- One run is enough; this is a "before shipping a big change"
  ritual, not continuous

The script reads SOCIALAPIS_TOKEN from env, never prints the value,
never persists it. It's gitignored-by-association via the .gitignore
additions for .env/.token files.

Also hardens .gitignore with defense-in-depth entries for env files
and tokens (.env, .env.*, *.token, .socialapis_token) so an accidental
commit doesn't land a secret in public history.

What the first run found (validation context, fix in a follow-up PR):
- All 12 endpoint calls work at the wire level — auth, routing,
  forwarding kwargs all good
- AuthenticationError mapping works correctly (bad token → 401)
- But the typed-model methods (get_page_info, get_profile_details,
  get_group_details) all return Pydantic models with no populated
  fields, because the real API:
    a) Wraps responses in inconsistent envelopes (key "0" for FB
       pages, "data" for IG profiles, no wrapper at all for FB
       groups)
    b) Uses different field names than my models guessed
       (likes_count not likes, followers_count not followers,
       media_count not posts_count, etc.)

Follow-up PR will fix the envelope extractor + correct field names,
then bump to v0.1.1.

The smoke test reads `page.id` and probes `BadRequestError` with a
nonexistent slug. Both assumptions need adjusting after the typed-
model rewrite in #6:

- PageInfo now uses `ad_page_id` (and `user_id`) — the API doesn't
  return a bare `id` field for pages. Updated the assertion.
- The API returns 200 with an empty payload for nonexistent page
  slugs, not a 4xx. To still validate the SDK's error mapping
  works against a real 4xx, the test now sends a deliberately
  malformed request (no params) which the API rejects with 400.

Stays self-contained — no new dependencies, no changes outside
scripts/integration_smoke.py.