Extract internal/hover/ → pkg/hoverclient for cross-repo reuse

[intel352]

Context

workflow-plugin-infra v2 ships per-provider DNS adapters under internal/dnsprovider/ (Route53, GCP, Azure, Namecheap, GoDaddy, Hover). Hover adapter needs the existing internal/hover/ HTTP client (508 LOC client.go + 74 LOC totp.go, stdlib-only — see workspace design-guidance.md on dogfood + reuse-over-rebuild).

Per workspace AGENTS.md: "emphasis on reusable code to minimize duplication." Copying 582 LOC into workflow-plugin-infra/internal/ violates that. Cleaner path: extract into pkg/hoverclient here, tag a release, let consumers import.

Scope

• Move internal/hover/client.go + internal/hover/totp.go → pkg/hoverclient/
• Update internal/hover/ callers to import pkg/hoverclient (or replace with thin shim if any internal-only types remain)
• Preserve existing test coverage (client_test.go + totp_test.go move with the package)
• Export the public surface needed by workflow-plugin-infra adapter: client construct, login (incl. TOTP), DNS list/upsert/delete record operations
• No behavior change. Pure refactor + visibility shift
• Tag a minor release after merge (~v0.3.0)

Acceptance

• pkg/hoverclient/ package compiles + tests pass
• internal/hover/ either deleted or reduced to plugin-internal glue
• Plugin still builds, releases, registers same module/step types
• godoc-visible public surface for: NewClient/Login/ListRecords/UpsertRecord/DeleteRecord (or equivalent names)
• Tag v0.3.0 (or per maintainer call) so consumers can pin

Consumers

• workflow-plugin-infra/internal/dnsprovider/hover.go (v2 DNS adapter, blocked on this)

Out of scope

• API surface redesign (cred-key normalization happens in the consumer adapter)
• Switching off HTML-scraping (Hover has no public API; that's intrinsic)