feat(core): typed serde, pagination, webhooks, tracing, and fixes

[OmarAlJarrah]

Adds a batch of optional building blocks to dexpace-sdk-core and fixes several correctness issues. Everything lands in core; the transport packages are unchanged. No public symbol was removed, so existing code keeps working unmodified.

New capabilities

• Tristate values (serde.tristate) — a three-way type distinguishing "a value", "explicit null", and "absent", so PATCH-style payloads can round-trip an explicit null without conflating it with an omitted field.
• Typed model codec (serde.codec) — a small encode/decode layer over the existing Serde protocol for moving between typed models and wire bytes, standard-library only.
• Webhook verification (http.webhooks) — verifies inbound webhook payloads (HMAC-SHA256, constant-time comparison, replay-window check) and unwraps the verified body.
• Pagination (pagination) — sync and async paginators that iterate items or pages over a configured pipeline, with cursor/token, page-number, and RFC 5988 Link-header strategies. Each page fetch runs the full pipeline, so retry, auth, and tracing apply per page.
• Idempotency-key and client-identity policies — the first stamps a key generated once per request and reused across retries onto write methods (so safe retries don't double-apply a side effect); the second sets a consistent User-Agent. Both are wired into the default pipeline.
• HTTP tracer and log correlation — an adapter-style tracer (no-op by default) carried on the instrumentation context and emitted from the tracing/redirect/retry policies, plus trace/span ids published to contextvars and stamped onto log records.

Correctness fixes

• Loggable response body no longer caches an empty body when the network drops mid-read — it keeps the partial bytes and re-raises; the one-time drain is now lock-guarded; both loggable bodies gain a bounded snapshot.
• SSE parser strips a leading byte-order mark; async response and SSE cleanup runs to completion under cancellation and re-raises CancelledError; a circular import between the errors package and the streaming module is broken.
• Digest auth negotiates its charset from the challenge (RFC 7616) instead of always using UTF-8.
• MediaType parameter parsing handles first-= splits, quoted/escaped values, key-only lowercasing, and unknown charsets.
• HTTP errors expose a retryable flag and a non-consuming body snapshot.
• The retry, redirect, and tracing policies now share a single per-operation HttpTracer: attempt-level events (attempt_started/attempt_failed/attempt_retries_exhausted) and the operation/request/response lifecycle events land on the same tracer instance instead of separate ones.
• An X-RateLimit-Reset wait is now jittered upward only, so a reconnect never wakes before the window resets — a downward jitter risked an immediate repeat 429. Retry-After is still respected and capped.
• The Link-header paginator resolves a relative RFC 5988 target against the request URL instead of raising on the missing scheme.
• The typed codec raises SerializationError when asked to encode non-UTF-8 bytes, rather than letting a UnicodeDecodeError escape.
• The async shielded-cleanup helper preserves cancellation precedence: if a cleanup coroutine raises an ordinary exception while a cancellation is pending, the cancellation still propagates rather than being masked by the cleanup error.

Tests and tooling

Adds behavioural conformance fixtures, serialization snapshot tests, and an ast-based public-API surface baseline that fails on unintended API changes.

Verification

ruff check, ruff format --check, mypy --strict (212 source files), and the full pytest suite (999 passing) are all green.