feat(api): introduce RequestConfigBuilder for SDK-agnostic abort signal support (#1008)

* feat(api): add RequestConfigBuilder class for SDK-agnostic request configuration

Body: Implement generic request configuration builder with chainable methods (addAbortSignal, addHeaders, setOption), static factory methods (fromMetadata, mergeAbortSignals), and 40 unit tests.

* docs(config-builder): enhance README with generic architecture design and multi-SDK examples

* fix(config-builder): fix broken TOC link and simplify mergeAbortSignals early-abort

- Fix README TOC: change #how-mergesignals-works to
  #how-mergeabortsignals-works to match the actual heading anchor
- Simplify mergeAbortSignals: return primarySignal directly when it's
  already aborted instead of creating a new AbortController

* fix: addHeaders default param and mergeAbortSignals order in RequestConfigBuilder (#615)

- Add default empty object parameter to addHeaders() so calling with
  undefined no longer throws TypeError from Object.keys(undefined)
- Reorder mergeAbortSignals to check primarySignal.aborted before
  allocating AbortController, preventing unnecessary controller creation

* refactor: use AbortSignal.any() for mergeAbortSignals

* feat(api): add abort signal builder utilities

* fix(api): prevent cleanup leaking into request config

* fix(api): chain request config cleanup

* docs(api): remove config builder readme

* fix(api): relax request config option constraints

* fix(api): address review feedback on request config builder

- rename addAbortSignal to setAbortSignal and document replace semantics
- type build()/fromMetadata() as Partial<TOptions> | undefined
- drop static mergeAbortSignals delegation in favor of the exported utility
- cover internal-controller abort propagation through addMergedSignal
- cover timeout-alone and primary-signal abort cases in abort-signal tests

* refactor(api): use native AbortSignal.timeout() in mergeAbortSignalAndTimeout

Replace the hand-rolled setTimeout/clearTimeout with AbortSignal.timeout(), which self-manages its timer. This removes the MergedAbortSignal cleanup contract and the leak risk when a caller forgets to run it, matching existing usage in zoo-code-auth, mcp oauth, and openai-codex oauth.

- mergeAbortSignalAndTimeout now returns AbortSignal | undefined

- RequestConfigBuilder drops getCleanup()/cleanupFn accumulation

* fix(api): isolate builder headers and harden config-builder tests

---------

Co-authored-by: Eason Liang <easonliang28@gmail.com>
Co-authored-by: Elliott de Launay <edelaunay@wealthsimple.com>