Add retry with backoff, and narrow the untyped responses

Retry:
- `RetryPolicy` (3 retries, full-jitter exponential backoff) applied in a
  new `execute` dispatch chokepoint, configurable via
  `with_retry_policy`. `Retry-After` is honoured, and one longer than
  `max_delay` is surfaced rather than slept through.
- What may be replayed depends on the method, not just the status. A 429
  means the server refused the request without processing it, so any
  method is safe. A 5xx or timeout gives no such guarantee, so only
  idempotent methods are retried: this is a billing API, and replaying a
  POST the server had already applied would duplicate an invoice,
  payment, or email.

Response types:
- `statics`, `search`, and `health_check` return `Statics`,
  `SearchResults`, and `HealthCheck` instead of being generic.
  `HealthCheck` covers both deployments — hosted returns a bare message
  rather than a report — and `SearchResults` covers both the
  Elasticsearch and non-Elasticsearch bucket sets.
- Each keeps the `extra` convention, and `statics_as` / `search_as` /
  `health_check_as` remain for pinning shapes left untyped. Nested config
  blobs (gateways, templates, extensions) stay `Value`, same reasoning as
  `Company::settings`.
- `send_email` previously decoded the response as a bare body, but the
  controller returns `itemResponse(...)` — a `data`-wrapped entity. It now
  unwraps, so `T` is the entity. Still generic, since the endpoint serves
  invoices, quotes, credits, and purchase orders.
- `chart` stays generic on purpose: the eleven charts share no response
  shape.
- Adds `id_as_string`, since `/statics` returns `payment_types.id` as a
  string and the other tables return numbers.

Adds CHANGELOG.md (Keep a Changelog), and a CLAUDE.md note to keep it
current. 17 new tests, 43 in client_requests.rs total.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -50,15 +50,25 @@ let all_clients = client.list_all_clients(&ListParams::new()).await?;
 ```
 
 Every request carries a 60-second deadline by default, since `reqwest`
-applies none of its own. Override it for slow report exports or large
-`list_all_*` walks:
+applies none of its own, and transient failures are retried up to 3 times
+with exponential backoff. Both are configurable:
 
 ```rust
 use std::time::Duration;
+use invoiceninjars::RetryPolicy;
 
-let client = InvoiceNinjaClient::hosted(token)?.with_timeout(Duration::from_secs(300));
+let client = InvoiceNinjaClient::hosted(token)?
+    .with_timeout(Duration::from_secs(300))
+    .with_retry_policy(RetryPolicy::new(5));
 ```
 
+Retrying is deliberately conservative about `POST`. A `POST` that fails with
+a 5xx or times out is **not** replayed, because the server may have applied
+it before the response was lost and a repeat would create a second invoice
+or payment. A 429 is retried for any method, since the server states it
+refused the request without processing it. Pass `RetryPolicy::none()` to
+disable retrying entirely.
+
 Run the example (requires `IN_API_TOKEN`, optionally `IN_BASE_URL`):
 
 ```sh