fix(cli): Every 403 blames the API key, even when a firewall sent it

[Alex Pezzati (alex-pezzati)]

Overview of Changes

• A 403 whose body is not JSON (the QA Wolf API answers every error with JSON) now says the request was blocked before it reached the API and that the API key was not checked.
• A 403 the API itself sent keeps the "check your API key" message.

In Tester session l0akd2vers1r8i5iz870923wocht, Google Cloud Armor blocked a runner.evaluateSnippet request with its HTML 403 page. The CLI told Tester to check its API key, which was fine, so Tester gave up and the session sat blocked for 15+ hours. The firewall rule itself is fixed in #2906 fix(cloud-armor): Tester's snippet on its own runner is rejected with HTTP 403. This PR fixes the message, so the next blocked request is not blamed on the key.

Not changed here: describeIdentityError still says "API key is invalid or unauthorized" for any 403 on the identity check. That call has no request body for a content rule to match, but a firewall rule that blocks by IP or region would still get blamed on the key. This is a separate gap worth tracking.

An empty 403 body, such as one whose read failed, is now read as a firewall block.

Fixes AGE-5827

Testing

describeErrors.test.ts adds a 403 with an HTML body, which failed before the fix. The existing "carries the server's reason" test covers a 403 with the API's JSON body.

bun run typecheck
bun run lint
bun run format:check
bun run knip
bun run test
bun run build

Checklist

• Changes follow the code style of this project
• Self-review completed
• Tests added/updated (or not applicable)
• No breaking changes (or described below)