fix(tng-wasm): clean up browser fetch-failure error logging

[imlk0]

Summary

Browser fetch failures in the wasm SDK (e.g. when the Attestation Service is unreachable) produced an opaque, duplicated error with no indication of what failed or why the reason is hidden:

3: JsValue(TypeError: Failed to fetch
   TypeError: Failed to fetch
       at __wbg_fetch_... (...)
       at wasm-function[1940]...
       ...)

Two problems:

1. TypeError: Failed to fetch was duplicated and wrapped in a raw JsValue(...).
2. No URL/method of the failing request, and no hint that browsers deliberately hide the underlying fetch reason.

What changed

reqwest fork (rev edd4658 → 472703b) — chore(deps): bump reqwest rev for cleaner wasm js_sys::Error printing
Rewrites the wasm-only crate::error::wasm() so a fetch rejection renders <name>: <message> once and the .stack once — no JsValue(...) wrapper, no duplication. On V8/Chrome the Error.stack itself begins with the <name>: <message> line, so the stack is used verbatim when it already starts with the head (instead of prepending it again). For fetch failures it appends a Note: explaining that browsers do not expose the underlying reason and listing common causes (server unreachable, mixed-content, CORS, TLS). Non-Error rejections fall back to the previous Debug rendering.

In-repo URL/method context — tng: attach URL/method context to AS fetch failures

• Additive pub fn as_addr() accessor chain across the converter types (CocoRestfulConverter/CocoGrpcConverter/BuiltinCocoConverter/ItaConverter → CocoConverter → TngConverter), mirroring the existing get_nonce/convert dispatch. Builtin returns a &'static str sentinel (no remote AS address). The Builtin arm is #[cfg(feature = "__builtin-as")]-gated to match the variant. This is additive-only on the published rats-cert crate — the rats-cert::Error enum is untouched.
• Lazy .with_context(|| format!(...)) at the two AS fetch sites in tng/.../security/client.rs (the /challenge get_nonce call and the key-config POST) so the failing address surfaces in the error chain, preserving the source chain (no stringification).

Test + harness — test(tng-wasm): assert clean rendering of browser fetch failures, fix(tng-wasm): pin wasm-bindgen-test ..., test(tng-wasm): handle firefox-specific fetch error message ...

• tng-wasm/tests/fetch_error.rs: a wasm_bindgen_test that fetches an invalid host and asserts the rendered rejection has no JsValue( wrapper, exactly one TypeError: Failed to fetch, and contains the Note: hint (Chrome). Firefox surfaces a different message (NetworkError when attempting to fetch resource.), so the message-count/Note assertions are skipped on Firefox; the no-JsValue(-wrapper check runs on both.
• Pin wasm-bindgen-test = "=0.3.50" (and the matching wasm-bindgen/web-sys/js-sys/wasm-bindgen-futures versions in Cargo.lock) to fix the wasm-pack "no tests to run!" harness issue, so the wasm tests actually execute.
• chore(wasm): drop redundant wasm-unit-test invocation — wasm-unit-test now just delegates to wasm-unit-test-chrome.

Resulting error chain (Chrome)

Failed to create OHTTP client

Caused by:
    0: Failed to request ohttp key config from server
    1: requesting challenge token from AS at <as_addr>
    2: Failed to send /challenge HTTP request to AS (api_version: V1_6_0)
    3: error sending request
    4: TypeError: Failed to fetch
       at __wbg_fetch_... (...)
       at wasm-function[1940]...
       Note: browsers do not expose the underlying reason for a fetch failure. Common causes: server unreachable, mixed-content (https page -> http url), CORS rejection, or TLS/certificate error.

Compatibility

Additive-only: new pub accessor methods on rats-cert converter types; no endpoint, config field, or public struct/field removed or renamed. The wasm-bindgen-test pin is a dev-dependency change. No docs/version_compatibility.md row needed.

Checklist

• cargo fmt, cargo check -p tng -p rats-cert, make clippy clean
• wasm test added and executes under make wasm-unit-test-chrome/-firefox after the harness pin fix
• No Co-Authored-By trailers, gpgsig, or AI attribution in any commit
• Live demo (tng-wasm/www/) wasm bundle rebuilt against the new reqwest rev for deployment (bundle is gitignored; built separately on deploy)

[shankailun-aliyun]

@imlk0 ，您好，您的请求已接收，请耐心等待结果。

[shankailun-aliyun]

@imlk0 ，您好，未检测到有镜像需要构建，如需重新检测请评论 /start 。

[codecov]

Codecov Report

❌ Patch coverage is 0% with 31 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...c/tunnel/ingress/protocol/ohttp/security/client.rs	0.00%	4 Missing and 4 partials ⚠️
rats-cert/src/tee/coco/converter/mod.rs	0.00%	6 Missing ⚠️
tng/src/tunnel/provider/converter.rs	0.00%	5 Missing ⚠️
rats-cert/src/tee/coco/converter/builtin.rs	0.00%	3 Missing ⚠️
rats-cert/src/tee/coco/converter/grpc.rs	0.00%	3 Missing ⚠️
rats-cert/src/tee/coco/converter/restful.rs	0.00%	3 Missing ⚠️
rats-cert/src/tee/ita/converter.rs	0.00%	3 Missing ⚠️

📢 Thoughts on this report? Let us know!