fix: surface upstream validation errors

[aorying]

What changed

This PR keeps upstream image-generation validation errors visible to callers instead of collapsing them into the generic safety-refusal path.

Specifically, when the OAuth proxy receives a non-retryable upstream 4xx response, such as an invalid image size, the server now returns the upstream status, error code, and actionable message back through both generation entry points:

• POST /api/generate
• POST /api/node/generate

Why

Before this change, an upstream request like 512x512 could fail validation, but the app retried it and eventually reported the failure as SAFETY_REFUSAL / Content generation refused after retries.

That made the CLI/API response misleading because the user action was not unsafe content; it was a request-parameter validation problem. The original upstream message already explains how to fix the request, so preserving it gives users a clear next step.

Before

ima2 gen "a simple red circle" -s 512x512 -o /tmp/test.png

Returned a generic refusal after retries:

Content generation refused after retries

After

The same request returns the original validation error without retrying:

Invalid size '512x512'. Requested resolution is below the current minimum pixel budget.

The response also preserves the upstream HTTP status and code, for example:

{
  "error": "Invalid size '512x512'. Requested resolution is below the current minimum pixel budget.",
  "code": "invalid_value"
}

Implementation notes

• Parses structured upstream OAuth error bodies for 4xx responses.
• Preserves the upstream message, code, type, and param on the thrown OAuth error object.
• Treats generation 4xx responses as non-retryable to avoid repeated invalid requests.
• Propagates non-retryable 4xx errors through both classic and node generation routes.
• Keeps existing generic handling for non-4xx failures and empty-image safety-refusal cases.

Tests

• npm test
• npm run lint:pkg

Added regression coverage for:

• OAuth 4xx validation responses preserving the actionable upstream message.
• /api/generate returning invalid-size validation errors instead of SAFETY_REFUSAL.
• /api/node/generate returning the same invalid-size validation error shape without retrying.