Switch httpclient default back-end over to libcurl (#832)

Switches the default HTTP client to the libcurl-based backend and follows up with a series of correctness fixes and code quality improvements to `CurlHttpClient`.

**Backend switch & build fixes:**
- Switch default HTTP client to libcurl-based backend
- Suppress `[[nodiscard]]` warning when building fmt
- Miscellaneous bugfixes in HttpClient/libcurl
- Pass `-y` to `xmake config` in `xmake test` task

**Boilerplate reduction:**
- Add `Session::SetHeaders()` for RAII ownership of `curl_slist`, eliminating manual `curl_slist_free_all` calls from every verb method
- Add `Session::PerformWithResponseCallbacks()` to absorb the repeated 12-line write+header callback setup block
- Extract `ParseHeaderLine()` shared helper, replacing 4 duplicate header-parsing implementations
- Extract `BuildHeaderMap()` and `ApplyContentTypeFromHeaders()` helpers to deduplicate header-to-map conversion and Content-Type scanning
- Unify the two `DoWithRetry` overloads (PayloadFile variant now delegates to the Validate variant)

**Correctness fixes:**
- `TransactPackage`: both phases now use `PerformWithResponseCallbacks()`, fixing missing abort support and a dead header collection loop
- `TransactPackage`: error path now routes through `CommonResponse`, preserving curl error codes and messages for the caller
- `ValidatePayload`: merged 3 separate header-scan loops into a single pass

**Performance improvements:**
- Replace `fmt::format` with `ExtendableStringBuilder` in `BuildHeaderList` and `BuildUrlWithParameters`, eliminating heap allocations in the common case
- Replace `curl_easy_escape`/`curl_free` with inline URL percent-encoding using `AsciiSet`
- Remove wasteful `CommonResponse(...)` construction in retry logging, formatting directly from `CurlResult` fields

1 files changed, 12 insertions, 13 deletions

diff --git a/src/zenhttp/clients/httpclientcurl.h b/src/zenhttp/clients/httpclientcurl.h
index 871877863..b7fa52e6c 100644
--- a/src/zenhttp/clients/httpclientcurl.h
+++ b/src/zenhttp/clients/httpclientcurl.h
@@ -75,40 +75,39 @@ private:
 	struct Session
 	{
 		Session(CurlHttpClient* InOuter, CURL* InHandle) : Outer(InOuter), Handle(InHandle) {}
-		~Session() { Outer->ReleaseSession(Handle); }
+		~Session();
 
 		CURL* Get() const { return Handle; }
 
+		// Takes ownership of the curl_slist and sets it on the handle.
+		// The list is freed automatically when the Session is destroyed.
+		void SetHeaders(curl_slist* Headers);
+
+		// Low-level perform: executes the request and collects status/timing.
 		CurlResult Perform();
 
+		// Sets up standard write+header callbacks, performs the request, and
+		// moves the collected body and headers into the returned CurlResult.
+		CurlResult PerformWithResponseCallbacks();
+
 		LoggerRef Log() { return Outer->Log(); }
 
 	private:
 		CurlHttpClient* Outer;
 		CURL*			Handle;
+		curl_slist*		HeaderList = nullptr;
 
 		Session(Session&&) = delete;
 		Session& operator=(Session&&) = delete;
 	};
 
-	Session AllocSession(std::string_view					  BaseUrl,
-						 std::string_view					  Url,
-						 const HttpClientSettings&			  ConnectionSettings,
-						 const KeyValueMap&					  AdditionalHeader,
-						 const KeyValueMap&					  Parameters,
-						 std::string_view					  SessionId,
-						 std::optional<HttpClientAccessToken> AccessToken);
+	Session AllocSession(std::string_view ResourcePath, const KeyValueMap& Parameters);
 
 	RwLock			   m_SessionLock;
 	std::vector<CURL*> m_Sessions;
 
 	void ReleaseSession(CURL* Handle);
 
-	struct RetryResult
-	{
-		CurlResult Result;
-	};
-
 	CurlResult DoWithRetry(std::string_view							 SessionId,
 						   std::function<CurlResult()>&&			 Func,
 						   std::unique_ptr<detail::TempPayloadFile>& PayloadFile);