feat(yarn_client): SSL/TLS config for YARN REST connections

Add per-Connection ssl_verify / ssl_ca_bundle plus global defaults so
CDH 5 / on-prem clusters with self-signed certs or custom CA bundles can
be queried without patching code.

- Connection gets ssl_verify (bool|None) and ssl_ca_bundle (str|None)
- Settings gets ssl_verify_default and ssl_ca_bundle_default
- New YarnClientConfig dataclass carries the resolved verify= value
- _request passes verify= through to httpx.request
- All public yarn_client functions now take YarnClientConfig instead of
  a bare yarn_rm_url string; tool call sites resolve the Connection
- SaveConnectionRequest exposes the two new fields

Tests cover per-connection CA bundle, per-connection verify=False,
global default fallback, and connection-not-found error.

tests/unit/test_status_tool.py

@@ -2,13 +2,26 @@
 from datetime import datetime
 from unittest.mock import patch
 
+import pytest
+
 from spark_executor.core.job_store import JobStore
-from spark_executor.models import Job
-from spark_executor.tools import status
+from spark_executor.core import connection_store
+from spark_executor.models import Connection, Job
+from spark_executor.tools import connections, status
+
+
+def _fresh_stores():
+    """Reset job store and connection store singletons for a single test."""
+    store = connection_store.ConnectionStore()
+    connection_store.store = store
+    connections.store = store
+    status.conn_store = store
+    status.store = JobStore()
 
 
 def test_get_job_status_returns_state():
-    status.store = JobStore()
+    _fresh_stores()
+    status.conn_store.save(Connection(name="prod", master="yarn", yarn_rm_url="http://rm:8088"))
     status.store.put(
         Job(
             job_id="abc",
@@ -28,12 +41,29 @@ def test_get_job_status_returns_state():
     assert out.application_id == "application_1"
     assert out.state == "RUNNING"
     assert "RUNNING" in out.raw
-    # yarn_rm_url is forwarded to the REST client
-    assert m.call_args.args == ("application_1", "http://rm:8088")
+    # resolved YarnClientConfig is forwarded to the REST client
+    args = m.call_args.args
+    assert args[0] == "application_1"
+    assert args[1].yarn_rm_url == "http://rm:8088"
 
 
 def test_get_job_status_raises_for_unknown_job():
-    status.store = JobStore()
-    import pytest
+    _fresh_stores()
     with pytest.raises(KeyError):
         status.get_job_status("missing")
+
+
+def test_get_job_status_raises_when_connection_missing():
+    _fresh_stores()
+    status.store.put(
+        Job(
+            job_id="abc",
+            application_id="application_1",
+            script_path="/tmp/j.py",
+            queue="default",
+            submit_time=datetime(2026, 6, 24),
+            connection="missing",
+        )
+    )
+    with pytest.raises(KeyError, match="Connection not found"):
+        status.get_job_status("abc")