* refactor: share one helper for the per-user sif config directory
the modules loader and the framework custom-signature loader each
hand-rolled the same ~/.config/sif/<sub> (and %LocalAppData%\sif\<sub>
on windows) path. extract internal/sifpath.UserSubdir and route both
through it so the per-user layout is defined in one place.
no behavior change: the helper reproduces the existing paths exactly.
* refactor: read capped response bodies through one httpx helper
the frameworks detector and the module executor each defined their own
5 MB body cap and ran the same io.ReadAll(io.LimitReader(...)) read. move
the cap and the read into httpx.MaxBodySize / httpx.ReadCappedBody so both
scanners share one ceiling instead of two consts that can drift.
no behavior change: the cap value and read semantics are unchanged.
