Sprint 3: Anti-bot retrieval layer + metrics module

Anti-bot changes (all 6 adapters):
- Browser-grade User-Agent rotation (Chrome/Firefox on Linux/Windows)
- Shared browser_headers() with Accept, Accept-Language, DNT
- Session-consistent UA fingerprint (picked once, not per-request)
- jitter_sleep() replaces fixed time.sleep() on all adapters
- Exponential backoff on 429/503 already on reddit, now consistent

New shared module:
- adapters/__init__.py: browser_user_agent(), browser_headers(), jitter_sleep()
- adapters/_http.py: HTTPClient class for future browser-mode adapters

Metrics module (from Sprint 2 carry):
- oracle/metrics.py: MetricsRun for log_adapter/log_verdicts/log_scores
- oracle/weekly.py: SYSTEM HEALTH section wired to adapter_health
- oracle/cli.py: metrics subparser with --adapters/--publish/--scores/--alerts

Before: bot signatures like 'ai-oracle/0.1', 'python:athena:v0.1'
After: 'Mozilla/5.0 (X11; Linux x86_64; rv:139.0) Gecko/20100101 Firefox/139.0'

adapters/huggingface.py

@@ -34,7 +34,7 @@ import urllib.request
 import urllib.error
 from datetime import datetime, timedelta, timezone
 
-from adapters import SourceAdapter
+from adapters import SourceAdapter, browser_user_agent, jitter_sleep
 from adapters._store import true_first_seen, upsert_entries
 
 
@@ -79,7 +79,7 @@ class HuggingFaceAdapter(SourceAdapter):
         return "huggingface"
 
     def _headers(self):
-        headers = {"User-Agent": "athena/0.1"}
+        headers = {"User-Agent": browser_user_agent()}
         if self.token:
             headers["Authorization"] = f"Bearer {self.token}"
         return headers
@@ -251,7 +251,7 @@ class HuggingFaceAdapter(SourceAdapter):
         if popular and isinstance(popular, list):
             all_models.extend(popular)
 
-        time.sleep(1)  # polite spacing
+        jitter_sleep(1)  # polite spacing
 
         # 2. Recently modified (sort=lastModified) — fresh models getting attention
         # Filter to models created in last 90 days to avoid noise