perf: add bounded oracle HTTP client (#2825)

## Why

Oracle-backed quote preparation currently creates a fresh HTTP client for every
pair and has no reusable bounded execution primitive. This adds connection-pool
reuse and a conservative per-origin limit before the quote sweep is made
concurrent.

## What changed

- add a reusable `OracleClient` backed by one native/WASM-compatible reqwest
  connection pool
- cap oracle POSTs at eight in flight per origin across independently created clients
- add ordered bounded execution that avoids head-of-line blocking
- route the existing single and batch APIs through the shared client without
  changing their signatures, timeout, response validation, or status handling
- add deterministic tests for the concurrency bound, shared limiter, positional
  stability, partial failure isolation, and slow-leading-request behavior

## Intentionally unchanged

- configured oracle URLs are not assumed to support batch request bodies
- no retries are added for 429/503 or other failures because the endpoint
  contract does not declare POST idempotency
- signed-context and chain quote behavior are unchanged in this prerequisite PR

## Local verification

- `cargo test -p raindex_quote --lib` — 63 passed
- `cargo clippy -p raindex_quote --all-targets --all-features -- -D warnings -D clippy::all`
- `cargo fmt --all -- --check`
- `nix develop .#wasm-shell -c bash -c 'CARGO_TARGET_WASM32_UNKNOWN_UNKNOWN_RUNNER=wasm-bindgen-test-runner cargo test --target wasm32-unknown-unknown --lib -p raindex_quote'`
- `rainix-rs-static`

## Review focus

Please pay particular attention to the per-origin limit of eight, indexed
`buffer_unordered` ordering restoration, and native/WASM client reuse.

<!-- This is an auto-generated comment: release notes by coderabbit.ai -->
## Summary by CodeRabbit

* **Performance**
  * Oracle requests now reuse shared HTTP resources for improved efficiency.
  * Concurrent requests are bounded, with configurable limits for improved stability under load.

* **Reliability**
  * Batch results preserve their original request order.
  * Individual request errors are reported without blocking other requests.
  * Requests now validate endpoints, apply timeouts, and redact sensitive URL details from errors.
  * Response handling and request validation are more consistent.
<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Author: findolor