refactor(http-recorder): use Schema.TaggedErrorClass for errors

Matches the codebase convention (LLMError, FileSystemError, AuthError,
etc. all use Schema.TaggedErrorClass). Adds SecretFindingSchema so the
findings field on UnsafeCassetteError has a real Schema rather than
an opaque type.