Add standard middlewares: logging, headers, auth, and panic recovery

- Logging: structured slog output with method, URL, status, duration
- DefaultHeaders/UserAgent: inject headers without overwriting existing
- BearerAuth/BasicAuth: per-request token resolution and static credentials
- Recovery: catches panics in the RoundTripper chain

middleware/recovery.go

@@ -0,0 +1,22 @@
+package middleware
+
+import (
+	"fmt"
+	"net/http"
+)
+
+// Recovery returns a middleware that recovers from panics in the inner
+// RoundTripper chain. A recovered panic is converted to an error wrapping
+// the panic value.
+func Recovery() Middleware {
+	return func(next http.RoundTripper) http.RoundTripper {
+		return RoundTripperFunc(func(req *http.Request) (resp *http.Response, err error) {
+			defer func() {
+				if r := recover(); r != nil {
+					err = fmt.Errorf("panic recovered in round trip: %v", r)
+				}
+			}()
+			return next.RoundTrip(req)
+		})
+	}
+}