Add bounded V3 request recovery and client sessions

[SproutSeeds]

I added finite request timeouts and bounded recovery for the V3 client. A
transient 503 can now recover, a 401 can refresh its scope token once, and
an HTTP 403 raises an HTTP error before JSON decoding. Each client owns its
Session, and a context manager releases its connections. Authentication POSTs
use one attempt and reject redirects.

The optional constructor settings expose timeout, retry count, retry wait
limit, and cancellation. Successful response shapes and 404 behavior stay
the same. Malformed responses now raise an explicit error. I also declared
Requests as a runtime dependency and added the offline suite to PR checks.

The installed wheel passes all 75 offline checks on Python 3.8.20, 3.9.6,
3.10.18, 3.11.13, and 3.12.11 on macOS arm64. That includes actual Requests
traffic to a loopback server, token refresh, cookie isolation, read timeout,
and rejected authentication redirects. Original lint and package builds pass.
Linux fork CI also passes all 75 installed wheel tests on Python 3.8 through
3.12: https://github.com/SproutSeeds/actiapi/actions/runs/34814951073.
The workflow checks out this exact contribution commit. Python 3.8 wheel
verification uses a wheel built with Python 3.12 because the existing build
backend requires Python 3.9 or newer. Lint and builds pass on the supported
build interpreters. The 13 existing live study tests remain unrun. This draft
leaves the retry defaults and changed error semantics open for review.

This draft depends on #27 and currently includes its token cache commit. The
recovery changes after that commit
are available separately for review. I will rebase this draft after #27 lands.

The upstream Actions run is waiting for maintainer approval. Both Snyk checks
report 1 test has failed, and the linked report requires a Snyk login. Could
you approve the Actions run and share the Snyk failure details so I can address
them? The fork verification above has completed.

Cody