feat: skill for http clients

[robhowley]

• External HTTP calls are infrastructure boundaries — isolate them behind a dedicated client module
• Use httpx.AsyncClient; never requests in async apps
• Reuse a single managed client instance; never instantiate per request or per call site
• Always configure explicit timeouts — connect, read, write, and pool
• Use tenacity for retries; never hand-roll retry loops
• Only retry transient failures on idempotent operations; don't retry 4xx
• Validate external payloads into typed schemas before they cross into the app
• Map upstream failures to domain-specific errors; don't leak HTTP concepts into business logic
• Centralize auth, base URL, headers, and credentials — never scatter or hardcode them
• Log and instrument at the boundary only; never log secrets
• Structure as a thin base client (transport/retry/logging) + thin vendor client (endpoints/validation/mapping)
• Make the integration layer trivially mockable in tests