feat: add Ktor networking layer with ApiService and auth token holder

Add ApiConfig, AuthTokenHolder singleton, expect/actual HttpClient
engine factories (CIO for Android/Desktop, Darwin for iOS), and
ApiService with four GET endpoints. Bearer token from AuthTokenHolder
is injected as Authorization header on each request.

Adjusted for Ktor 3.5.1: HttpClientEngineFactory lives in
io.ktor.client.engine; the timeout plugin is HttpTimeout (package
io.ktor.client.plugins), not HttpTimeoutPlugin. Tests wrap suspend
calls in runTest and assert request URLs without a trailing '?'.

composeApp/src/androidMain/kotlin/ch/parano/myice/network/ApiEngine.android.kt

@@ -0,0 +1,7 @@
+package ch.parano.myice.network
+
+import io.ktor.client.engine.HttpClientEngineConfig
+import io.ktor.client.engine.HttpClientEngineFactory
+import io.ktor.client.engine.cio.CIO
+
+actual fun createEngine(): HttpClientEngineFactory<HttpClientEngineConfig> = CIO