feat(14-01): guarded fetchguard client replayed through a tide upstream fake

- fetchguard.NewClient with Do, Send, Get and PostJSON over a capped, never-redirecting transport
- WithTransport: code-only context seam for offline replay; Result gains Header
- tide UpstreamSidecar, LoadUpstream, UpstreamPath and the asserting UpstreamFake

modules/tide/testdata/upstream/post_json.upstream.yaml

@@ -0,0 +1,17 @@
+version: 1
+exchanges:
+  - request:
+      method: POST
+      url: https://api.example.test/v1/things?mode=fast&lang=en
+      headers:
+        Accept: application/json
+        Authorization: Bearer {{secret:example-token}}
+        Content-Type: application/json
+        User-Agent: example-client/1.0
+      body: '{"name":"widget","count":2,"tags":["a","b"]}'
+    response:
+      status: 201
+      headers:
+        Content-Type: application/json
+        X-Request-Id: req-123
+      body: '{"id":7,"name":"widget"}'