feat(http-request): add throwOnError, onRetry, streaming body, parseRetryAfter, sanitizeHeaders (#146)

Add new HTTP helpers to enable SDK deduplication:

- HttpResponseError class: thrown on non-2xx when throwOnError is enabled
- throwOnError option: makes non-2xx responses throw (enabling retry)
- onRetry callback: customize retry behavior per-attempt (skip 4xx, honor Retry-After)
- Streaming body support: body accepts Readable/FormData, auto-merges getHeaders()
- parseRetryAfter(): RFC 7231 Retry-After header parser (strict integer + HTTP-date)
- sanitizeHeaders(): redact sensitive headers for safe logging

Safety:
- Stream bodies rejected with retries > 0 (one-shot, not replayable)
- Redirects disabled for stream bodies
- settled/resolveOnce/rejectOnce guards prevent double-settle on all paths
- rejectOnce destroys stream body to avoid descriptor leaks
- res.resume() drains redirect response bodies
- emitResponse wrapped in try/catch for hook error resilience
- onRetry delay clamped (negative → 0, NaN → default)
- maxResponseSize cleanup destroys both response and request

Author: jdalton