feat(keycardai-oauth): pool httpx clients in the transports

[devin-ai-integration]

Summary

Closes ECO-329. HttpxTransport and HttpxAsyncTransport built and closed an httpx client inside every request_raw, so a long-lived keycardai Client/AsyncClient paid a fresh TCP and TLS handshake per call. Each transport now creates its client lazily on first use and reuses it; the client is configured exactly as before (verify_ssl, User-Agent, config.timeout as the client default) and the per-request timeout still flows through request(timeout=...), falling back to config.timeout when not given.

Lifecycle:

HttpxTransport.close()            # closes the pooled httpx.Client; next use creates a fresh one
HttpxAsyncTransport.aclose()      # same for httpx.AsyncClient
Client.close() / Client.__exit__            -> transport.close()  (only if the client created the transport)
AsyncClient.aclose() / AsyncClient.__aexit__ -> transport.aclose() (was a documented noop)

An injected transport is never closed by the client. An unclosed client is fine: httpx releases connections on garbage collection, stated in the docstrings rather than adding finalizers.

The two traps from the ticket:

1. Event-loop lifetime: HttpxAsyncTransport records asyncio.get_running_loop() at creation. A request on a different loop drops the old client (its aclose() cannot be awaited from a foreign loop, so it is left to GC, commented at the seam) and creates a fresh one. aclose() from a foreign loop likewise drops without awaiting.
2. Lazy-creation races: sync creation is behind a threading.Lock with a double check; async creation has no await between the check and the assignment, so one loop cannot double-create.

Observable behavior change (also in the commit body, which cz renders into the changelog): a pooled connection can die between requests, so a first attempt after idle can surface a transport error where a fresh-client design could not. Those already classify retryable=True.

Out of scope, deliberately: the module-level PKCE helper (pkce/_issuer.py) and the WIF token sources in server/credentials.py keep per-request clients; no ClientConfig injection knob.

Tests (tests/keycardai/oauth/http/test_transports.py, patched at the httpx.Client/httpx.AsyncClient seam, no network): identity reuse across two requests, config passthrough, timeout override vs fallback, close()/aclose() set is_closed and the next use creates a fresh client, NetworkError wrapping and operation string unchanged, 8-thread concurrent first use creates one client, gather on one loop creates one client, two asyncio.run() calls hold different clients, and foreign-loop aclose() drops without closing. test_client.py gains TestClientClose for the owned vs injected transport paths.

Verification: oauth 521 passed; langchain, temporal, starlette, fastmcp green. packages/mcp has two failures that are identical on main (auto_register_client assertions, unrelated).

Link to Devin session: https://app.devin.ai/sessions/bbc062cf32b548ef9c4b8b444d2ec67f
Open in Devin Desktop: https://app.devin.ai/desktop/session/bbc062cf32b548ef9c4b8b444d2ec67f?variant=devin
Requested by: @Larry-Osakwe

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR. Add '(aside)' to your comment to have me ignore it.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment, CI, and merge conflict monitoring

[Larry-Osakwe]

Everything the prompt pinned is pinned, plus the ownership rule it should have asked for: injected transports are never closed, only client-created ones, with tests both ways. The loop-change and foreign-loop-aclose semantics are exactly right (drop without awaiting, pinned by is_closed staying False), and the timeout handling actually improved: timeout=0 now honored instead of falling through the old or-fallback.