Classify auth/network errors and validate OFREP construction

[EtaCassiopeia]

Summary

Implements #123 (typed Unauthorized/Unreachable errors) and #122 (OFREP construction validation) — workstream A3 + A4 of the 1.0-readiness plan.

A4 — typed auth/network errors

• New cases in FeatureFlagError:
  • Unauthorized(reason: String) — operator-actionable signal that the remote provider rejected the request (HTTP 401/403 or analogous). Distinguishes a misconfigured SDK key from a generic provider error.
  • Unreachable(cause: Throwable) — network-layer failure (DNS, connection refused, no route). Distinct from a slow response (ProviderError(TimeoutException)) or an HTTP-level rejection.
• FeatureFlagError.classify(t: Throwable) — single classifier used wherever the library wraps an underlying Throwable from a provider. Recognises UnknownHostException, ConnectException, NoRouteToHostException, and matches common HTTP auth exception classes / messages (401, 403, Unauthorized, Forbidden). Everything else falls back to ProviderError(t) with the cause preserved.
• All 7 ProviderError(_) call sites in FeatureFlagsLive route through classify now. No code path was lost — ProviderError remains the fallback.
• isProviderError and toErrorCode updated for the new cases.

A3 — OFREP construction validation

• New ZIO-effectful factories on OFREPProvider:
  • make(baseUrl: String): IO[FeatureFlagError.InvalidConfiguration, OfrepProvider]
  • make(options: OfrepProviderOptions): IO[FeatureFlagError.InvalidConfiguration, OfrepProvider]
  • layer(baseUrl: String): ZLayer[Any, FeatureFlagError.InvalidConfiguration, OfrepProvider]
  • layer(options: OfrepProviderOptions): ZLayer[Any, FeatureFlagError.InvalidConfiguration, OfrepProvider]
• Validation rules: non-empty after trim, parseable URI, scheme http/https, non-empty host.
• Legacy throwing factories (apply(), apply(baseUrl), fromOptions) kept for backwards compatibility but annotated @deprecated so callers migrate over time.
• The existing WireMock integration spec was migrated to the validated factory via a small makeProvider test helper, so the recommended API is also the one exercised in CI.

Closes #122
Closes #123