Single chokepoint Client.do now inspects the response on 403/429 and,
when the headers say we're rate-limited (X-RateLimit-Remaining=0 or a
Retry-After value), sleeps until the reset and retries once. The sleep
honors ctx cancellation, so callers bound the wait with
context.WithTimeout if they want a deadline.
RequestError gains a Headers field so the retry decision can read the
underlying response without re-fetching.
330f492666