Separate hermetic tests from scheduled provider contracts

[Claudio9701]

Parent

• [W5] Test architecture and external-service reliability #67

Outcome

Pull-request tests remain hermetic while respectful scheduled contracts detect upstream Geofabrik, HDX, and Overpass/OSMnx drift using shared finite HTTP defaults.

Scope

• add one identifying pooled session with finite timeouts and bounded GET retries
• migrate direct provider requests away from timeout-free module calls
• keep POST operations non-retrying by default
• replace brittle exact live-network assertions with structural provider contracts
• run provider contracts weekly and on manual dispatch, never as PR prerequisites
• document the explicit pytest override needed to opt back into sockets

Acceptance criteria

• normal tests cannot access sockets
• direct UrbanPy requests identify the project and always have finite timeouts
• retry policy respects Retry-After and excludes POST
• live contracts make only read-only structural assertions
• live failures are visible without blocking unrelated PRs