feat(rest): wrap catalog responses in HttpResponse

[plusplusjiajia]

Which issue does this PR close?

Closes #2993.

What changes are included in this PR?

#2838 added HttpRequest; responses were still unwrapped. This adds the counterpart.

• New response.rs (mirroring request.rs) with HttpResponse { status, headers, body }. query_catalog and post_form return it, so reqwest::Response no longer appears outside HttpClient — catalog.rs doesn't even import it any more.
• deserialize_catalog_response and deserialize_unexpected_catalog_error are no longer async: the body is already read.
• post_form returns HttpResponse instead of (StatusCode, Vec<u8>). Breaking, but that method landed in #2838 and hasn't been released.

The body is buffered as a Vec<u8> (not bytes::Bytes, to keep another third-party type out of the public API), and Debug is hand-written since a token exchange answers with a credential in the body.

Buffering is eager, so a body-read failure now surfaces on paths that ignored the body before — a drop_table that gets 200 and then loses the connection used to return Ok(()) and now errors. Narrow window, and failing loudly seems right, but it is a semantic change. HEAD/204/304 are unaffected.

Also cleared this crate's cargo doc warnings, which aren't a CI gate today — including a dangling Self::without_session link left by the rename in #2994.

Are these changes tested?

76 tests. New ones pin HttpResponse round-tripping status/headers/body through a real response, Debug holding back the body and sensitive headers, the unexpected-status error carrying status/headers/body, and a truncated-body error naming its URL — the last three were previously unpinned.