refactor: replace yarn CLI shell-out with YARN REST API

yarn_client.py no longer invokes the 'yarn' binary via subprocess; it uses
httpx against /ws/v1/cluster/apps/* endpoints. This means the runtime image
no longer needs the Hadoop client installation — the only YARN-side
dependency left in the container is the config dir consumed by
spark-submit itself.

New model field:
  - Job.yarn_rm_url: str | None
  - PendingSubmission.yarn_rm_url: str | None (snapshotted at prepare)

prepare_submit_job snapshots Connection.yarn_rm_url into the pending
record (consistent with the existing master/deploy_mode/spark_conf
snapshot pattern); confirm_submit_job copies it onto the Job so
status/logs/kill can use it without re-looking-up the connection.

Resolution order for the RM URL at runtime:
  1. Job.yarn_rm_url (preferred — survives connection edits/deletes)
  2. Connection.yarn_rm_url fallback (if a future tool is added that
     doesn't go through a Job)
  3. YARN_RESOURCE_MANAGER_URL env var

Errors:
  - YarnConfigError (HTTP 4xx semantics) when URL is missing/malformed
  - YarnError for HTTP 4xx/5xx from the RM, network failures, missing
    state field, or unparseable log responses

10 new tests in test_yarn_client.py cover the REST surface:
success, 404, 5xx, missing state field, env-var fallback, malformed
URL, log 404 with log-aggregation hint, kill PUT body shape, and
httpx connection-error wrapping.

tests/unit/test_submit_tool.py

@@ -18,7 +18,12 @@ def _fresh(tmp_path: Path, monkeypatch):
     monkeypatch.setattr(pending_store, "store", PendingStore())
     submit.conn_store = connection_store.store
     submit.pending_store = pending_store.store
-    connection_store.store.save(Connection(name="prod", master="yarn", deploy_mode="cluster"))
+    connection_store.store.save(Connection(
+        name="prod",
+        master="yarn",
+        deploy_mode="cluster",
+        yarn_rm_url="http://rm:8088",
+    ))
 
 
 def _last_pending_id() -> str:
@@ -45,6 +50,7 @@ def test_prepare_persists_pending_with_snapshot(monkeypatch):
             name="prod",
             master="yarn",
             deploy_mode="cluster",
+            yarn_rm_url="http://rm:8088",
             spark_conf={"spark.sql.shuffle.partitions": "200"},
         )
     )
@@ -54,6 +60,7 @@ def test_prepare_persists_pending_with_snapshot(monkeypatch):
     assert p.connection == "prod"
     assert p.master == "yarn"
     assert p.deploy_mode == "cluster"
+    assert p.yarn_rm_url == "http://rm:8088"
     assert p.spark_conf == {"spark.sql.shuffle.partitions": "200"}
     assert p.queue == "research"
     assert p.script_path == "/tmp/j.py"
@@ -100,6 +107,8 @@ def test_confirm_invokes_spark_submit_and_marks_submitted(monkeypatch):
     assert p.status == "SUBMITTED"
     assert p.application_id == "application_17400000001"
     assert p.job_id is not None
+    # job carries the connection's yarn_rm_url snapshot
+    assert submit.job_store.get(p.job_id).yarn_rm_url == "http://rm:8088"
 
 
 def test_confirm_raises_for_unknown_pending_id():