feat(14-01): fetchguard client covers PUT, multipart, bearer and a trusted mode

- TrustedMode (declared after PublicOnlyMode) lifts the scheme, host and dial checks for Client only
- PutJSON, PostMultipart with FormField/FormFile, Bearer
- tests for modes, redirects, multipart order, body cap and the scheme guard
- README, root modules row and outbound HTTP docs describe the client and its test seam

modules/fetchguard/client_internal_test.go

@@ -0,0 +1,54 @@
+package fetchguard
+
+import (
+	"net/http"
+	"net/http/httptest"
+	"sync/atomic"
+	"testing"
+	"time"
+)
+
+func TestClientNeverFollowsRedirects(t *testing.T) {
+	handler := func(followed *atomic.Bool) http.Handler {
+		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+			if r.URL.Path == "/target" {
+				followed.Store(true)
+				return
+			}
+			http.Redirect(w, r, "/target", http.StatusFound)
+		})
+	}
+	for _, mode := range []Mode{AllowHostsMode, PublicOnlyMode, TrustedMode} {
+		var followed atomic.Bool
+		var srv *httptest.Server
+		policy := Policy{Mode: mode, AllowHosts: []string{"127.0.0.1"}, MaxBytes: 1024, Timeout: 5 * time.Second}
+		if mode == TrustedMode {
+			srv = httptest.NewServer(handler(&followed))
+		} else {
+			srv = httptest.NewTLSServer(handler(&followed))
+			policy = withTestLoopback(srv, policy)
+		}
+		c, err := NewClient(policy, nil)
+		if err != nil {
+			t.Fatal(err)
+		}
+		res, err := c.PostJSON(t.Context(), srv.URL+"/start", nil, map[string]int{"n": 1})
+		srv.Close()
+		if err != nil {
+			t.Fatalf("mode %d: %v", mode, err)
+		}
+		if res.StatusCode != http.StatusFound || res.Header.Get("Location") != "/target" {
+			t.Fatalf("mode %d: status %d location %q, want the 302 itself", mode, res.StatusCode, res.Header.Get("Location"))
+		}
+		if followed.Load() {
+			t.Fatalf("mode %d: redirect target was requested", mode)
+		}
+	}
+}
+
+func TestNewClientNegativeLimitsUseDefaults(t *testing.T) {
+	if _, err := NewClient(Policy{Mode: PublicOnlyMode, MaxBytes: -1, Timeout: -1}, nil); err != nil {
+		// Negative limits fall back to defaults like zero does.
+		t.Fatalf("NewClient: %v", err)
+	}
+}