feat(yarn_client): SSL/TLS config for YARN REST connections

Add per-Connection ssl_verify / ssl_ca_bundle plus global defaults so
CDH 5 / on-prem clusters with self-signed certs or custom CA bundles can
be queried without patching code.

- Connection gets ssl_verify (bool|None) and ssl_ca_bundle (str|None)
- Settings gets ssl_verify_default and ssl_ca_bundle_default
- New YarnClientConfig dataclass carries the resolved verify= value
- _request passes verify= through to httpx.request
- All public yarn_client functions now take YarnClientConfig instead of
  a bare yarn_rm_url string; tool call sites resolve the Connection
- SaveConnectionRequest exposes the two new fields

Tests cover per-connection CA bundle, per-connection verify=False,
global default fallback, and connection-not-found error.

tests/unit/test_kill_tool.py

@@ -2,13 +2,26 @@
 from datetime import datetime
 from unittest.mock import patch
 
+import pytest
+
+from spark_executor.core import connection_store
 from spark_executor.core.job_store import JobStore
-from spark_executor.models import Job
+from spark_executor.models import Connection, Job
 from spark_executor.tools import kill
+from spark_executor.tools import connections
+
+
+def _fresh_stores():
+    store = connection_store.ConnectionStore()
+    connection_store.store = store
+    connections.store = store
+    kill.conn_store = store
+    kill.store = JobStore()
 
 
 def test_kill_job_calls_yarn_kill():
-    kill.store = JobStore()
+    _fresh_stores()
+    kill.conn_store.save(Connection(name="prod", master="yarn", yarn_rm_url="http://rm:8088"))
     kill.store.put(
         Job(
             job_id="abc",
@@ -22,7 +35,9 @@ def test_kill_job_calls_yarn_kill():
     )
     with patch("spark_executor.tools.kill.kill_application") as m:
         result = kill.kill_job("abc")
-    m.assert_called_once_with("application_1", "http://rm:8088")
+    args = m.call_args.args
+    assert args[0] == "application_1"
+    assert args[1].yarn_rm_url == "http://rm:8088"
     assert result == {
         "job_id": "abc",
         "application_id": "application_1",
@@ -31,7 +46,22 @@ def test_kill_job_calls_yarn_kill():
 
 
 def test_kill_job_raises_for_unknown_job():
-    kill.store = JobStore()
-    import pytest
+    _fresh_stores()
     with pytest.raises(KeyError):
         kill.kill_job("missing")
+
+
+def test_kill_job_raises_when_connection_missing():
+    _fresh_stores()
+    kill.store.put(
+        Job(
+            job_id="abc",
+            application_id="application_1",
+            script_path="/tmp/j.py",
+            queue="default",
+            submit_time=datetime(2026, 6, 24),
+            connection="missing",
+        )
+    )
+    with pytest.raises(KeyError, match="Connection not found"):
+        kill.kill_job("abc")