feat(net-core): capability traits

[NotAProfDev]

Summary

Add all remaining capability trait modules to oath-net-core.
These are the policy-boundary traits that every net-<backend> and adapter-* crate depends on as bounds.

Depends on: #12 (composition primitives must be merged first)
Spec: crates/net/core/PLAN.md — Layer 1 § Capability traits, § HTTP / WS operation contracts, § Module layout.

---

Files to create

File	Contents
endpoint.rs	HttpEndpoint — operation descriptor (method, path, etc.)
metadata.rs	RequestMetadata — per-request weight annotation and context
rate_limit.rs	RateLimiter trait
retry.rs	RetryPolicy trait
session.rs	SessionProvider trait
circuit.rs	CircuitBreaker trait
concurrency.rs	ConcurrencyLimiter trait
load_shed.rs	LoadShedPolicy trait
auth.rs	AuthProvider trait
codec.rs	Codec trait
ws.rs	WsClient, WsMessage, WsCloseFrame (uses futures-core / futures-sink bounds)
client.rs	HttpClient thin compat shim (if needed)

lib.rs

Update with mod declarations and pub use re-exports for all new modules (in addition to those added in #12).

---

Design constraints (from PLAN.md)

• Every trait is RPITIT — fn … -> impl Future<…> + Send. No async-trait, no dyn.
• net-core has zero runtime deps — no tokio, hyper, reqwest, tracing, serde, or thiserror.
• WsClient uses futures-core::Stream and futures-sink::Sink for its split-half signatures.
• AuthProvider and Codec are kept deliberately minimal — broker-specific logic lives in adapter-<broker>.
• LoadShedPolicy decisions take RequestMetadata as input so broker adapters can supply per-endpoint priority rules without importing backend internals.

---

Acceptance criteria

• just ci passes
• All 9 traits (RateLimiter, RetryPolicy, SessionProvider, CircuitBreaker, ConcurrencyLimiter, LoadShedPolicy, AuthProvider, Codec, HasErrorKind) are pub from the crate root
• WsClient compiles with futures-core / futures-sink bounds and no concrete runtime
• No tokio, hyper, serde, thiserror anywhere in the crate
• All public items have /// doc comments (enforced by missing_docs lint)