test(client,adapters): retry policy + streaming terminal arms + credential/header-parameter arms (CLI-03, COV-10, COV-12)

- new tests/retry_policy_wire.rs: POST+500 = 1 upstream hit (method
  gate), GET 500/503/200 = 3 hits (retry-to-success), budget exhaustion
  stops retries under a 50-attempt cap (wall-time + hit-count bounds)
- forward_stream terminal arms on the wire: oversized SSE line ->
  one INTERNAL terminal envelope; mid-stream transport abort (staged
  via a notify gate so the abort is genuinely mid-stream) -> terminal
  envelope after the delivered frame; pending event EOF-flush; dead
  port through both forward() and forward_stream()
- Once-path decode arms: malformed application/json 200 -> INTERNAL
  decode envelope; application/octet-stream 200 -> byte-array envelope
- COV-12 credential arms: ApiKey and Basic malformed values fail
  loudly without echoing secret material; declared header-param
  invalid name/value rejections
- new tests/client_config_reload.rs: config() reflects a reloaded
  config (FWD-12 atomicity half)

tests/client_config_reload.rs

@@ -0,0 +1,33 @@
+//! COV-12/FWD-12: `SharedHttpClient::config()` reflects the config the
+//! running clients were built from, and a `reload` swaps the config
+//! together with both clients in one atomic store — after a reload,
+//! `config()` shows the new generation and the old one is unreachable
+//! for every late reader (FWD-12's atomicity assertion).
+
+use std::time::Duration;
+
+use alkhttp::client::{HttpClientConfig, SharedHttpClient};
+
+#[test]
+fn config_accessor_tracks_a_reloaded_config() {
+    let initial = HttpClientConfig {
+        retry_after_ceiling: Duration::from_secs(11),
+        ..HttpClientConfig::default()
+    };
+    let http = SharedHttpClient::new(initial).expect("initial client builds");
+    assert_eq!(
+        http.config().retry_after_ceiling,
+        Duration::from_secs(11),
+        "config() starts as the config the client was built from"
+    );
+    let reloaded = HttpClientConfig {
+        retry_after_ceiling: Duration::from_secs(22),
+        ..HttpClientConfig::default()
+    };
+    futures::executor::block_on(http.reload(reloaded)).expect("reload succeeds");
+    assert_eq!(
+        http.config().retry_after_ceiling,
+        Duration::from_secs(22),
+        "config() reflects the reloaded generation, not the initial one (FWD-12)"
+    );
+}