feat(http): HMAC-SHA256 request signing + token refresh on 401

[vietnguyentuan2019]

What

Ships #81: HttpRequestWorker gains optional HmacSigningConfig (HMAC-SHA256 request signing) and TokenRefreshConfig (auto-refresh + one-shot retry on 401) — Flutter parity Group 2.

Design

Both are config-scoped, not installed on HttpClientProvider's shared singleton client (which is process-wide across all workers) — so different workers/calls can carry different secrets and refresh endpoints without stepping on each other.

• HMAC signing: canonical METHOD\nURL\nBODY\nTIMESTAMP → HMAC-SHA256 via Okio's built-in ByteString.hmacSha256 — no platform-specific crypto/expect-actual needed. Hex-encoded, optional prefix (e.g. sha256= for GitHub-webhook style). signBody/includeTimestamp toggle what's covered.
• Token refresh: on 401, POST a configurable refresh endpoint, extract the new token via a dot-notation JSON path (e.g. auth.access_token), retry the original request exactly once with the refreshed token. Never loops.

Security review (folded in before this PR, not left as follow-up)

• refreshUrl now passes SecurityValidator.validateURL() — checked in HttpRequestWorker.doWork() (fails fast, same as the primary url) and again inside TokenRefresh.refreshToken() itself, so any future caller adopting TokenRefreshConfig (HttpSyncWorker, HttpUploadWorker, …) gets the SSRF gate for free instead of needing to remember it — the same drift class SecureRedirectFollowing.kt's own KDoc warns about.
• Real bug caught by the tests: Ktor's header() appends, not replaces — injecting the refreshed Authorization header without removing the stale one first sent both values on retry.
• A GET/DELETE's config.body (never written to the wire) is excluded from what gets signed — previously the signature covered bytes the server would never receive.
• A blank token in the refresh response is treated as a failed refresh, not retried with Authorization: Bearer .
• Corrected KDoc that incorrectly claimed the HMAC signature covers headers (including a refreshed Authorization) — it only covers METHOD/URL/BODY/TIMESTAMP.

Testing

./gradlew :kmpworker-http:iosSimulatorArm64Test :kmpworker-http:testDebugUnitTest :kmpworker:testDebugUnitTest — 64/64 on iOS, Android green. New coverage: known-vector HMAC signature test, GET-with-body exclusion, append-vs-replace header regression, token-refresh happy path / still-401 / refresh-endpoint-failure / blank-token / no-config-passthrough, SSRF-blocked refreshUrl at both the doWork() and refreshToken() layers, and extractByDotPath edge cases (missing key, non-object mid-path, null, array, numeric, empty path).