feat: add GSA eBuy requests, attachment URL and access check

[makegov-mark]

What

Adds the GSA eBuy endpoints from Tango API 5.1.0.

Method	Endpoint	Returns
list_ebuy_requests(opts) / iterate_ebuy_requests(opts)	GET /api/ebuy/requests/	Page<Record> / PageStream<Record>
get_ebuy_request(rfq_id, opts)	GET /api/ebuy/requests/{rfq_id}/	Record
get_ebuy_attachment_url(rfq_id, doc_seq_num)	GET /api/ebuy/requests/{rfq_id}/attachments/{doc_seq_num}/download/	String
get_ebuy_access()	GET /api/ebuy/access/	EbuyAccess (typed)

• ListEbuyRequestsOptions names every filter the endpoint accepts (search, rfq_id, reference_number, request_type, status, sin, schedule, buyer_agency, agency, contract_number, issue/close date bounds) plus ordering.
• SHAPE_EBUY_REQUESTS_MINIMAL mirrors the API's default list shape.
• get_ebuy_attachment_url reads the 302 with redirects disabled and returns the Location (resolved against the request URL) instead of following it. Following it would download the document and send the API key to the download host.
• An attachment that is an outbound link (400 with url) surfaces as the new Error::ExternalLink { url, .. } variant; Error is #[non_exhaustive], so this is additive.
• New builder option no_redirect_http_client overrides the dedicated no-redirect client, for callers whose proxy/TLS setup must apply to that call too.
• The transport retry loop is factored into a shared helper so the redirect-reading call retries 429/5xx/transport errors under the same policy.

Behavior documented in rustdoc, docs/API_REFERENCE.md and the CHANGELOG: Pro plan required; the list is scoped to the caller's linked schedule contracts and is empty (not an error) without one, which get_ebuy_access disambiguates; status is frozen at last-seen state.

Testing

• cargo fmt --all -- --check, cargo clippy --workspace --all-features --all-targets -- -D warnings, cargo test --workspace all green.
• Unit tests for query emission, the empty-id guard and EbuyAccess decoding.
• httpmock wire tests: list/get/access routes; the attachment URL is returned and the redirect target is never requested (verified the test fails when the call uses the redirect-following client); relative Location resolution; the link-entry 400 maps to ExternalLink with its url; an uncaptured document maps to NotFound.
• No live integration test: exercising these endpoints needs a key on an account with a linked schedule contract.

🤖 Generated with Claude Code