feat: cURL bundle exporter core (#42)

[rwrife]

Closes #42 (partially — see follow-ups).

What changed

First slice of the export system from #42: a pure, VS Code-free exporter that turns a set of parsed .http files into a runnable bash curl bundle.

• src/core/export/curl.ts — takes ExportInputFile[] and options (secret redaction list, custom placeholder, optional banner), returns { script, requestsWritten, warnings }. Reuses the existing requestToCurl renderer and toUndiciRequest zod validation, so any bug fixes there flow through automatically.
• Secret redaction — applied to URL, headers, body and the # request: … label comment above each curl line. A secret in a query string can't leak through the comment even after the curl line has been redacted. Custom placeholder is honoured.
• Graceful skips — .grpc / .ws inputs in a mixed .requests/ tree produce an unsupported-kind warning instead of failing the export. Empty .http files produce a no-requests note.
• Zod fallout — per-request toUndiciRequest failures surface as invalid-request warnings without aborting the rest of the bundle.
• Deterministic output — no timestamps, no random ordering; test snapshots stay stable.
• README — new ## Exporting to other tools section explaining what's landed and what's next.

Tests

+11 unit tests in test/export.curl.test.ts. Full suite: 409 passed. Lint + typecheck clean.

Follow-ups (still open on #42)

• Reqit: Export to cURL bundle… command wiring (scope picker → current file / current folder / entire .requests/ tree; env picker; SecretStorage enumeration for the redact list; export-report webview; workspace path guard).
• src/core/export/postman.ts — v2.1 collection JSON, round-trip against src/core/import/postman.ts fixtures.
• src/core/export/openapi.ts — OpenAPI 3.1 YAML/JSON stub generated from operations + history examples.

Kept intentionally small so the pure core lands first and can back both the extension command and any future CLI reqit export subcommand without duplication.