fix(api:curl): buffer stdout to prevent 401 error body in output

When a 401 triggers token refresh and retry, the error response body
from the initial request was being written to stdout before the retry.
With --fail-with-body, curl outputs error bodies to stdout while the
status code appears in stderr via --verbose.

Buffer stdout when retryOn401 is enabled. Only write the buffer after
the request completes successfully. If 401 is detected, discard the
buffer before retrying.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

Author: pjcdawkins

src/Service/CurlCli.php

@@ -76,18 +76,25 @@ public function run($baseUrl, InputInterface $input, OutputInterface $output) {
         $process = new Process($commandline);
         $shouldRetry = false;
         $newToken = '';
-        $onOutput = function ($type, $buffer) use ($censor, $output, $stdErr, $process, $retryOn401, &$newToken, &$shouldRetry) {
+        $stdoutBuffer = '';
+        $onOutput = function ($type, $buffer) use ($censor, $output, $stdErr, $process, $retryOn401, &$newToken, &$shouldRetry, &$stdoutBuffer) {
             if ($shouldRetry) {
                 // Ensure there is no output after a retry is triggered.
                 return;
             }
             if ($type === Process::OUT) {
-                $output->write($buffer);
+                if ($retryOn401) {
+                    // Buffer stdout so it can be discarded if a 401 triggers a retry.
+                    $stdoutBuffer .= $buffer;
+                } else {
+                    $output->write($buffer);
+                }
                 return;
             }
             if ($type === Process::ERR) {
                 if ($retryOn401 && $this->parseCurlStatusCode($buffer) === 401 && $this->api->isLoggedIn()) {
                     $shouldRetry = true;
+                    $stdoutBuffer = '';
                     $process->clearErrorOutput();
                     $process->clearOutput();
 
@@ -107,6 +114,11 @@ public function run($baseUrl, InputInterface $input, OutputInterface $output) {
 
         $process->run($onOutput);
 
+        if (!$shouldRetry && $stdoutBuffer !== '') {
+            $output->write($stdoutBuffer);
+            $stdoutBuffer = '';
+        }
+
         if ($shouldRetry) {
             // Create a new curl process, replacing the access token.
             $commandline = $this->buildCurlCommand($url, $newToken, $input);
@@ -118,6 +130,10 @@ public function run($baseUrl, InputInterface $input, OutputInterface $output) {
 
             $stdErr->writeln(sprintf('Running command: <info>%s</info>', $censor($commandline)), OutputInterface::VERBOSITY_VERBOSE);
             $process->run($onOutput);
+
+            if ($stdoutBuffer !== '') {
+                $output->write($stdoutBuffer);
+            }
         }
 
         return $process->getExitCode();