feat(client): shared reqwest client host with retry stack and Retry-After

- src/client/http_client.rs: SharedHttpClient (ArcSwap rebuild-and-swap
  hot-reload), HttpClientConfig/ClientCertConfig, HttpClientBuildError
- src/client/retry_after.rs: inlined RetryAfterMiddleware — 429/503
  Retry-After (seconds + HTTP-date), bounded URL->deadline storage with
  earliest-deadline eviction, sleep-before-next-request
- middleware stack: RetryTransientMiddleware (exponential backoff) +
  RetryAfterMiddleware; credentials stay per-request via
  OperationContext.capabilities (no env reads)
- applied poisoned-lock recovery convention (into_inner)

Verified: cargo test (95 lib tests), clippy -D warnings, fmt.

tasks/client/http-host.md

@@ -1,7 +1,7 @@
 ---
 id: client-http-host
 name: Shared reqwest client host (middleware stack, retry-after)
-status: pending
+status: completed
 depends_on: []
 scope: narrow
 risk: low
@@ -23,10 +23,10 @@ client construction, never from env vars.
 
 ## Acceptance Criteria
 
-- [ ] Client host ported with the middleware stack; inlined Retry-After (bounded storage)
-- [ ] ArcSwap hot-swap tested (config change → new pool)
-- [ ] No env-var reads (invariant test)
-- [ ] `cargo test` passes
+- [x] Client host ported with the middleware stack; inlined Retry-After (bounded storage)
+- [x] ArcSwap hot-swap tested (config change → new pool)
+- [x] No env-var reads (invariant test)
+- [x] `cargo test` passes
 
 ## References
 
@@ -39,4 +39,16 @@ client construction, never from env vars.
 
 ## Summary
 
-> Agent fills on completion.
+Ported `src/client/` (http_client.rs + retry_after.rs): SharedHttpClient
+(ArcSwap<ClientWithMiddleware> + ArcSwap<HttpClientConfig>, rebuild-
+and-swap reload), HttpClientConfig/ClientCertConfig, thiserror
+HttpClientBuildError (CaBundleRead/Parse, ClientCertRead/Parse, Build),
+concat_pem cert+key joining, RetryAfterMiddleware (429/503 Retry-After
+parse: seconds + HTTP-date via httpdate; bounded URL->deadline storage
+with earliest-deadline eviction; sleep-before-next-request).
+
+Convention applied: poisoned Mutex recovered via
+`unwrap_or_else(|e| e.into_inner())` per AGENTS.md error handling.
+
+24 tests (12 retry-after incl. LRU eviction + sleep, 12 http client
+incl. ArcSwap reload ptr-neq + no-env-var invariant). 95 lib tests green.