fix(core): транзиентный 401 теперь ретраится для GET

isRetryable (core/http.go): добавлен StatusUnauthorized (401) к {429,502,503,504}.
Gateway может временно отклонять валидный JWT — без этого одиночный 401 ронял
read/plan/поллинг.

- client_test.go: юнит-тест TestIsRetryable (401/429/502/503/504 = true; 400/403/404/500 = false).
- ARCHITECTURE.md: раздел API Resilience приведён к фактическому поведению
  (401 реализован; POST не ретраится намеренно).

Проверено: go build ./... OK; go test ./internal/core/... -short OK.

TOOLS/ARCHITECTURE.md

@@ -123,9 +123,11 @@ Each operation has a kind:
 
 - Core MUST retry transient 401 errors from Gateway (3 attempts, exponential backoff).
   Gateway may temporarily reject valid JWT tokens.
-- **CURRENTLY NOT IMPLEMENTED** — `isRetryable` (`core/http.go`) retries only
-  {429, 502, 503, 504}, NOT 401, and only for GET. This is a known gap versus the
-  intent above; fix in `core/http.go` `isRetryable`.
+- Implemented: `isRetryable` (`core/http.go`) includes 401 alongside {429, 502, 503, 504};
+  retry applies to GET requests only.
+- Network errors and HTTP retryable statuses are retried for **GET only**. POST is not
+  retried (a blind retry of the creating `POST /instanceOperations` could duplicate an
+  operation — see open question on idempotency).
 
 ### Generated Code Resilience