Pull the private `client`/`postJSON` from `internal/ai` into a standalone
`internal/httpclient` package so both the AI providers and the upcoming
webhook senders can share the same bounded-reader, timeout-guarded JSON
HTTP client without introducing a dependency cycle.
Changes:
- internal/httpclient: Client struct with PostJSON(ctx, url, headers,
payload, out), functional options WithTimeout/WithTransport, a 4 MiB
response cap, and a 60s default timeout
- internal/ai: three providers (OpenAI, Ollama, Anthropic) now embed an
`*httpclient.Client` (field renamed from `client` to `http`); the old
`client.go` is deleted
- All 11 test packages pass (ai tests are byte-for-byte unaffected)
This zero-behaviour refactor unblocks the webhook package distributed in
M5, which needs the exact same JSON-post-and-decode helper.
