Add ApiConfig, AuthTokenHolder singleton, expect/actual HttpClient
engine factories (CIO for Android/Desktop, Darwin for iOS), and
ApiService with four GET endpoints. Bearer token from AuthTokenHolder
is injected as Authorization header on each request.
Adjusted for Ktor 3.5.1: HttpClientEngineFactory lives in
io.ktor.client.engine; the timeout plugin is HttpTimeout (package
io.ktor.client.plugins), not HttpTimeoutPlugin. Tests wrap suspend
calls in runTest and assert request URLs without a trailing '?'.
herel
