refactor: extract the auth/HTTP layer from cli.py #60

Follow-up to #30 (#55). cli.py is still ~2,950 lines because the auth and HTTP layer stayed put:

• OIDC / device / token-exchange login flows and the local callback server
• _make_client, _request_with_retry, make_request, handle_response, SSE streaming
• spec fetching and caching (fetch_spec)

Why it was deferred: ~60 test sites patch these through the cli module (patch("openapi_cli4ai.cli._make_client"), cli.webbrowser, cli.HTTPServer, cli.httpx.*), so the move needs a matching test sweep, best done as its own PR.

Proposal

• http.py: client factory, retry, request/response handling, SSE
• auth.py: header builders and the login flows
• spec.py: fetch/cache/ref-resolution
• cli.py keeps commands only; re-exports for patch compatibility during the move, then tests switch to the owning module

Acceptance

• Modules extracted; behavior unchanged
• Full suite green; patch targets updated to the owning modules
• cli.py under ~1,500 lines

Effort: M