test(oauth-proxy): don't fail CI when a live upstream is unreachable

[viktormarinho]

Problem

apps/mesh/src/api/routes/oauth-proxy.integration.test.ts (run in the blocking storage-integration gate) proxies OAuth metadata / authorize redirects from ~13 live third-party MCP servers (Stripe, OpenRouter, Notion, Supabase, Vercel, …) and asserts the proxy's discovery/rewriting contract (200/302).

When one of those servers is slow or down, the proxy correctly returns 502 (bad gateway), but the test asserted 200/302 → red gate. This is a recurring external-dependency flake — the OpenRouter .well-known fetch timing out at ~12s has now blocked unrelated PRs (#4180, #4181).

Fix

Skip a server's contract assertions when the proxy reports the upstream is unreachable (HTTP 502, which none of these tests ever expects), with a loud console.warn. Applied uniformly to all four live-server loops (protected-resource metadata, auth-server metadata, authorize redirect, resource-param rewrite).

• Every reachable server is still fully asserted.
• Any non-502 status flows through to the real expectations, so a genuine proxy regression is never masked — only third-party outages stop reddening the merge gate.

No production code touched; tsc + oxlint clean.

🤖 Generated with Claude Code

---

Summary by cubic

Make the OAuth proxy E2E tests tolerant of live upstream outages by skipping a server’s assertions when the proxy returns 502 (upstream unreachable). This prevents flaky CI from third‑party downtime while keeping full checks for reachable servers.

• Bug Fixes
  • Added a helper to detect 502 responses and log a warning, then skip that server’s assertions.
  • Applied to all live-server checks: protected-resource metadata, authorization-server metadata, authorize redirect, and resource param rewrite.
  • Non-502 responses still run existing expectations; no production code changed.

^{Written for commit 642ec21. Summary will update on new commits.}