fix: read HTTP response bodies exactly once

[asachs01]

Port of the single-read response fix proven in node-connectwise-automate#54 (root cause of connectwise-automate-mcp#54) — API calls returning {} and then failing with Body is unusable: Body has already been read. The same defect existed verbatim in this repo's src/http.ts.

Root cause (src/http.ts handleResponse)

1. Double body read: the error path did await response.json() (consumes the one-shot body stream, throws on non-JSON) then await response.text() in the catch on the same consumed body → undici's Body is unusable TypeError, masking the real response. Hosted instances front the API with WAF/proxy HTML error pages, so this fires exactly when the diagnostics matter most.
2. Silent empty success: a 200 whose content-type wasn't application/json returned {} — login pages / WAF challenges read as successful-but-empty API calls.

Fix

Read the body exactly once as text, then parse:

• JSON parses regardless of the content-type header (some proxies mislabel).
• Genuinely empty 200/204 keeps the historical {} shape.
• Non-JSON 200 now raises HaloPsaError with the content-type and a body snippet — surfacing WAF/proxy interference diagnosably instead of pretending success.
• Error paths get the parsed-or-raw body in their typed errors, never a second read.

src/auth.ts already reads each response exactly once per branch — left untouched.

Verification

• 7 new tests in tests/unit/http.test.ts using real Response objects so one-shot body-stream semantics are actually exercised — against the unfixed code 4 of them fail with the exact reported Body is unusable TypeError.
• Full suite 86/86, lint clean, typecheck clean, build clean.