Adds SharedHttpClient wrapping ArcSwap<ClientWithMiddleware> with a RetryTransientMiddleware + inlined RetryAfterMiddleware stack. HttpClientConfig covers pool, timeout, retry policy, and optional CA bundle/client cert. reload() rebuilds and swaps via ArcSwap. No env-var reads; credential injection is per-request, not at construction.