feat(destination, agent-memory, core): support binding rotation in HTTP clients

[cassiofariasmachado]

Disclaimer: Do not include SAP-internal or customer-specific information in this PR (e.g. internal system URLs, customer names, tenant IDs, or confidential configurations). This is a public repository.

Description

Introduces a shared HttpClient + XsuaaAuthProvider layer in core/ that all service module transports compose. Solves a silent failure mode where long-lived clients hold frozen credentials — after a BTP secret rotation the old token expires and every call fails with 401 until the client is re-instantiated.

Two layers of rotation resilience:

• Proactive: ConfigFactory.has_changed() checks the binding directory mtime before serving each cached token; on change it evicts the full token cache and re-reads credentials immediately.
• Reactive: HttpClient.request invalidates the token cache entry and retries once on any 401 response.

Migrates both destination and agent_memory modules to compose HttpClient directly (removes HttpTransport from agent_memory; replaces TokenProvider in destination). Rewrites unit test suites for both modules to use module-level mock_http fixtures and a _make_response helper.

Related Issue

No linked issue.

Type of Change

• Bug fix (non-breaking change that fixes an issue)
• New feature (non-breaking change that adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update
• Code refactoring
• Dependency update

How to Test

1. Run uv run pytest tests/agent_memory/ — 248 passed, 12 skipped
2. Run uv run pytest tests/destination/ — all passing
3. Run uvx pre-commit run --all-files — all hooks pass (ruff-format, ruff-check, ty)

Checklist

• I have read the Contributing Guidelines
• I have verified that my changes solve the issue
• I have added/updated automated tests to cover my changes
• All tests pass locally
• I have verified that my code follows the Code Guidelines
• I have updated documentation (if applicable)
• I have added type hints for all public APIs
• My code does not contain sensitive information (credentials, tokens, etc.)
• I have followed Conventional Commits for commit messages

Breaking Changes

None. AgentMemoryClient and DestinationClient public APIs are unchanged. Internal HttpTransport class is removed but was never part of the public API.

Additional Notes

• auditlog and data_anonymization modules are out of scope for this PR and can adopt HttpClient in a follow-up.
• data_anonymization uses mTLS and would need an MTlsAuthProvider implementation.
• ConfigFactory is generic (ConfigFactory[C]) and can be reused by any future module that needs binding re-read on rotation.