[API Proposal]: Add record-and-replay (pass-through proxy) to capture real traffic into mocks

## Motivation

#124 proposes importing mocks from curl commands and HAR files. This is the other half of that story: capturing the traffic in the first place.

Writing mocks by hand for an existing API is tedious, and it is easy to get the shape of the real response subtly wrong. Letting the test hit the real service once, recording the exchange, and replaying it offline afterwards turns mock authoring into a one-off recording step. That is a strong adoption lever for legacy codebases that currently have no HTTP tests at all.

## Proposed API

```csharp
// Recording pass: unmatched requests go to the real server and are written to disk
mock.PassThroughUnmatched()
.RecordingTo("Recordings/github.json");

// Replay pass: no network access, responses served from the recording
mock.LoadRecordings("Recordings/github.json");
```

## Notes

- Should interop with the HAR format from #124 where possible, so recordings are readable by other tooling.
- Needs a scrubbing hook for secrets, so `Authorization` headers and similar are not committed to the repository. Redact by default, opt in to keeping values.
- `PassThroughUnmatched()` interacts with `FailOnUnexpectedCalls` — pass-through should override the fail-fast behaviour while recording.
- Probably a separate package, since it needs a real `HttpMessageHandler` and file I/O.

Start with the proposed PassThroughUnmatched(), RecordingTo(), and LoadRecordings() entry points, then review issue #124 for HAR requirements. Define the separate package boundary around HttpMessageHandler and file I/O, including recording, offline replay, secret scrubbing, and FailOnUnexpectedCalls behavior. Done means the API and these interactions are specified well enough to implement and test.

Written by the indexing model from the issue text.