[codeapplied]

Closes #27.

• New http_client.py: get_session() returns a requests.Session with a mounted retry adapter (3 retries, exponential backoff, retries on connection errors + 502/503/504).
• Deliberately relies on urllib3's default allowed-methods policy — GET/PUT/DELETE retried, POST is not. Retrying a failed POST that actually reached the server (response just got lost) risks creating a duplicate record — every create-type call in this project (Pipedrive deal/org/note creation, calendar event creation, Graph token requests) is a POST, so none of them get automatic retries. This wasn't hand-rolled per-call-site logic — it's the safe, well-known default behavior of a standard library, just wired in consistently everywhere.
• Wired into every outbound HTTP call site: pipedrive.py, graph_auth.py, onedrive_sync.py, calendar_sync.py, canadabuys_feed.py.
• Existing tests updated to patch requests.Session.request instead of module-level requests.get/post/put (since all of Session's verb methods funnel through .request() internally, this is actually a more robust single patch target than the per-verb patches used before).

Verified: 59/59 tests pass (55 existing + 3 new for the retry config + 1 more from a prior PR); smoke-tested both the offline sandbox pipeline and a real live network call against the CanadaBuys feed through the retry-wrapped session to confirm normal successful requests still work unchanged.