feat: add service account support

[lajohn4747]

Summary

Add service account support to the SDK so that endpoints such as import and feature flags can be validated through service accounts.

• ServiceAccountCredentials class
• Service accounts take precedence over deprecated API secret/key methods
• Add deprecation notes for api secrets
• Added tests

[linear-code]

MULTI-563

[Copilot]

Pull request overview

Adds first-class service account authentication support to the Mixpanel Node SDK, enabling authenticated use of endpoints like /import and server-side feature flags, while deprecating legacy API secret/key authentication.

Changes:

• Introduces ServiceAccountCredentials (new module + export) and wires it into /import request auth + project_id handling.
• Extends feature flags providers to accept optional credentials and use service-account Basic auth + project_id query param when provided.
• Updates tests, examples, and README to document/recommend service accounts and adds deprecation warnings for secret/key.

Reviewed changes

Copilot reviewed 12 out of 13 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
packages/openfeature-server-provider/test/MixpanelProvider.test.ts	Simplifies mock provider setup used by OpenFeature server provider tests.
packages/mixpanel/test/send_request.js	Updates /import auth error expectation to match new message.
packages/mixpanel/test/import.js	Adds service-account credential tests and deprecation-warning tests.
packages/mixpanel/test/flags/local_flags.js	Adds a local flags test case for providing service account credentials.
packages/mixpanel/readme.md	Documents service account authentication as the recommended approach and deprecates API secrets.
packages/mixpanel/lib/mixpanel-node.js	Implements service-account auth for /import, adds deprecation warnings, propagates credentials to flags providers, and exports ServiceAccountCredentials.
packages/mixpanel/lib/mixpanel-node.d.ts	Updates TS declarations to include ServiceAccountCredentials and credentials init config.
packages/mixpanel/lib/flags/utils.js	Extends common flags query params to optionally include project_id.
packages/mixpanel/lib/flags/remote_flags.js	Plumbs optional credentials through to the shared flags base provider.
packages/mixpanel/lib/flags/local_flags.js	Plumbs optional credentials through to the shared flags base provider.
packages/mixpanel/lib/flags/flags.js	Adds service-account auth/header/query behavior for feature flags requests.
packages/mixpanel/lib/credentials.js	Adds the ServiceAccountCredentials implementation.
packages/mixpanel/example.js	Updates example usage to prefer service accounts and marks API secret flow as deprecated.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 13 changed files in this pull request and generated 6 comments.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 16 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 16 changed files in this pull request and generated no new comments.

[tylerjroach]

secret is currently the only way to import, so on upgrade 100% of importing users get a logger.warn deprecation. Patch 13 fixed the earlier per-request spam so it now fires once per client at init — good. But in serverless / per-request-client setups that's once per cold start, and it hits api_key users too.