test: add httptest-based API client tests + fix revoked session detection

- Add 20 tests in pkg/api/client_test.go covering:
  - GetQuote: promo applied, no promo, invalid promo rejected (400), promo
    field present in request body
  - ListPlans: filters disabled + out-of-stock, empty results
  - ListRegions: filters out-of-stock
  - ListTemplates: returns all
  - CreateDeployOrder: promo sent in body, promo omitted when empty (omitempty)
  - Auth: 401 expired vs 401 revoked distinction
  - GetDefaultPaymentMethod: returns default, returns nil when none set
  - GetInstance: wrapped {instance:{}} format and direct {} format
  - GetDefaultAPIURL: https accepted, http/invalid/missing-host rejected

- Fix production bug: 401 revoked detection never worked because the inline
  struct used Code string but ErrorResponse encodes Code as int, causing
  json.Unmarshal to fail silently and always fall through to ErrTokenExpired.
  Fix: drop the Code field from the inline struct (only Detail is needed).

- Add auth.ResetDefaultStore() for test isolation

Author: hassan-bazzi

pkg/api/client.go

@@ -104,7 +104,6 @@ func (c *Client) doRequest(method, path string, body interface{}) (*http.Respons
 		resp.Body.Close()
 		var errResp struct {
 			Detail string `json:"detail"`
-			Code   string `json:"code"`
 		}
 		if json.Unmarshal(body, &errResp) == nil {
 			if strings.Contains(errResp.Detail, "revoked") {