fix: address code review feedback for GRAPE provider

[Claude]

Addresses review feedback on PR #42 to improve error handling, thread safety, and documentation accuracy in the GRAPE provider implementation.

Thread safety improvements:

• Replaced mutex-based caching with sync.Once in getProvisioningServerID() and getEndpointsURL() to prevent race conditions and duplicate API calls under concurrent load
• Separated debug mutex from cache fields for cleaner synchronization

Error handling enhancements:

• makeHawkRequest() now properly handles io.ReadAll errors and returns structured APIError for HTTP 4xx/5xx responses
• GrapeDevice.Register() distinguishes transport-level errors (DNS, connection, timeout) from API errors, only wrapping the former as connection_to_remote_provider_failed

// Callers can now inspect API errors
err := client.RegisterDevice(mac, url)
var apiErr grape.APIError
if errors.As(err, &apiErr) {
    // Handle specific HTTP status codes
}

Documentation fixes:

• Clarified that GRAPE uses Hawk authentication (HMAC-based), not OAuth, in README and environment variable descriptions
• Updated API manual to use errors.As() instead of type assertion for error checking
• Changed Go version requirement to reference go.mod instead of hardcoded value

URL handling:

• NewClient() normalizes BaseURL to ensure trailing slash, preventing malformed URLs during endpoint concatenation