fix: correctness, resource-handling, and documentation fixes across the SDK

[OmarAlJarrah]

Summary

A pass over the SDK fixing correctness and resource-handling bugs that the type
checker and existing tests did not catch, together with a documentation refresh
so the prose matches the shipped API. No new runtime dependencies. The public
surface is unchanged apart from three deliberate narrowings called out below.

Each fix lands with a regression test, and the commits are grouped by subsystem
so they can be reviewed independently.

Notable fixes

HTTP layer

• Importing the request package before the response package raised
  ImportError from a module cycle; an annotation-only import now sits under
  TYPE_CHECKING.
• The SSE parser split a single event in two when a CRLF terminator landed on
  a read-chunk boundary; a trailing CR is now held until the next byte
  disambiguates it.
• Control-character validation ran only in the Headers constructor, so a
  CR/LF value could be injected through Request.with_header; every mutator
  now validates. A directly-constructed HttpHeaderName is lower-cased so it
  matches the case-insensitive store.
• Async request bodies now validate chunk_size, FileRequestBody
  content-length is clamped to the bytes actually available, form encoding
  honours the requested charset, and the async stream body's close is shielded
  against a second cancellation.
• Non-UTC aware datetimes are normalised before formatting an HTTP date,
  ETag.parse rejects an embedded quote, suffix byte-ranges share the public
  HttpRange type so they compose in format_many, and the paginator wrappers
  take explicit typed parameters.

Pipeline

• Status-driven retries and non-reissuable redirects closed neither the in-hand
  response nor its connection; both now close before continuing. The
  synchronous retry's status-path sleep moved outside the try so a deadline
  timeout propagates instead of being reclassified and retried (matching the
  async policy), and the injected clock now reaches the async policy's inner
  configuration so an HTTP-date Retry-After is deterministic.
• The per-call ContextStore entry is evicted once run completes, so the
  store no longer grows without bound across calls with distinct trace ids.
• StagedPipelineBuilder.from_pipeline raises a clear error on a bare-callable
  step it cannot rehydrate instead of an opaque AttributeError.

Auth

• Digest declines (rather than raising) on credentials it cannot encode under
  the negotiated charset and on a session-variant algorithm offered without
  qop; it no longer emits cnonce/nc on a qop-less response, and
  preferred_algorithms now acts as an allow-list.
• AsyncBearerTokenPolicy gained the challenge-handler and 401/407 handling its
  synchronous counterpart already had.

Webhooks — a non-ASCII signature candidate is skipped instead of raising out
of verify, an empty decoded secret is rejected at construction, and the
timestamp must be a plain ASCII integer.

Serialization — mapping keys are encoded symmetrically with the decode side
so a dict keyed by an enum/date/UUID survives a round trip, a bare Tristate
annotation keeps its tri-state meaning, and a caller-supplied json default
chains behind the built-in datetime/bytes encoders instead of replacing them.

Instrumentation / config / errors — the URL redactor replaces the whole
parameter (key included) so a bare token carried as a query key is no longer
logged; non-finite durations are rejected; NO_PROXY uses conventional suffix
matching; SdkError keeps a coherent traceback when given an explicit cause;
and a loggable response body re-raises a base exception after recording it
rather than replaying a partial body as complete.

Transports — connect- and read-phase timeouts are classified consistently
across the adapters (so the retry policy never auto-retries a non-idempotent
request whose response may be in flight), the asyncio transport maps read-phase
errors into the SDK hierarchy and stops overwriting a caller's Host header,
and a status code outside the known set releases its connection before raising.
The aiohttp client refuses use after close instead of opening a fresh session.

Documentation

The README, CHANGELOG, project guide, and docs pages now reflect the real
default pipeline order and the subsystems that had shipped without mention
(webhook verification, the pagination package, the idempotency and
client-identity policies, correlation, and the reconnecting SSE client). A
broken import in the pipelines guide, a dangling reference in the architecture
guide, an inverted claim about retry body buffering, a reference to a
non-existent error type, and several stale value-object/auth descriptions are
corrected.

Conventions

Docstrings use the project's plain-backtick convention throughout, and a new
test scans every package source and test file so Sphinx cross-reference roles
cannot reappear (neither ruff nor mypy inspects docstring prose).

Public surface changes (intentional)

• Removed RetryConfig — it was exported but unwired; RetryPolicy is the
  real configuration surface.
• HttpRange.suffix now returns HttpRange (previously a private type) so a
  suffix range composes with format_many.
• CallContext is now an abc.ABC (it declares no abstract methods, so
  existing subclasses are unaffected).

The static API-surface baseline is regenerated to match.

Testing

• uv run ruff check and uv run ruff format --check: clean
• uv run mypy --strict: clean (227 source files)
• uv run pytest: 1141 passing (+128), with a regression test for each fix