feat(net): AuthSource + Auth/SetHeaders layers + Guarded body (Slice 0 PR 3)

CHANGELOG.md

@@ -28,6 +28,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   `HttpClient` (blanket-impl'd `Service` sub-trait), `ResponseBody` (buffer-xor-
   stream, forwarding `Body` metadata), and `BufferMode`. New `oath-adapter-net-
   http-mock` test harness (`MockClient`, `MockBody`, `MockTimer`).
+- `oath-adapter-net-http-api` construction seams — `AuthSource` (per-attempt
+  credential stamping) with `NoAuth`, the `Auth` layer (innermost, so `Retry`
+  re-stamps per attempt) and `SetHeaders` (static defaults outside `Auth`,
+  dynamic wins), and `Guarded` (response body carrying an optional `async-lock`
+  concurrency permit, released at the earlier of stream-end or drop). ADR-0034
+  records the construction-surface decisions and the ADR-0030/0031 amendments.
 - `oath-adapter-net-ws-api` WebSocket contract (ADR-0032/0033) — `Frame`/`CloseFrame`
   (RFC 6455 frame vocabulary), `WsError` (one concrete transport error with
   `HasErrorKind`), the split owned halves (`WsSink` one-shot RPITIT send half with

Cargo.toml

@@ -60,6 +60,9 @@ oath-core-api = { path = "crates/core/api", version = "0.1.0" }
 oath-core-kernel = { path = "crates/core/kernel", version = "0.1.0" }
 
 # External shared — backend-specific deps belong in individual crate Cargo.toml files
+# Runtime-neutral concurrency semaphore (event-listener family) — carries the
+# Guarded body's concurrency permit, keeps tokio out of net-http-api (ADR-0034 §2).
+async-lock = "3"
 # Runtime-neutral last-value channel (extracted from tokio::sync::watch,
 # event-listener family) — keeps tokio out of net-ws-api (ADR-0033 §5).
 async-watch = "0.3"

crates/adapter/net/http/api/Cargo.toml

@@ -7,6 +7,7 @@ license.workspace = true
 
 [dependencies]
 oath-adapter-net-api = { workspace = true }
+async-lock = { workspace = true }
 thiserror = { workspace = true }
 http = { workspace = true }
 bytes = { workspace = true }