fix(clk-gateway): log unhandled route errors, harden ZyFi failure paths

[Douglasacost]

Rebased onto main. Scope narrowed substantially: the original version of this PR duplicated #118, which had already landed. Everything #118 covers has been dropped. What remains is additive only.

1. Unhandled route errors are never logged

src/index.ts — the global error middleware returns a 500 to the client but never logs:

const message = err instanceof Error ? err.message : String(err);
res.status(500).json({ error: message });

No unexpected error, on any route, leaves a server-side trace. Now logs message and stack for 500s, and handled HttpErrors at warn level with method and URL. #118 did not touch this.

2. Network-level failures are indistinguishable from HTTP rejections

A DNS, TLS, or connection-reset failure means the request never reached ZyFi, so there is no status or body to report. Previously this surfaced as an unhelpful generic throw. Now reported explicitly as a network failure.

3. response.json() ran before the ok check

This is a latent gap in #118:

const responseBody = await response.json();   // <-- before the ok check
if (!response.ok) { ... }

If a proxy or load balancer in front of ZyFi returns HTML or an empty body — a 502/504 — response.json() throws a SyntaxError and the status is discarded, reproducing exactly the blind spot #118 set out to close. The body is now read as text first and parsed after, so the status survives a non-JSON response.

The operation label convention from #118 is preserved throughout.

Verification

• npx tsc --noEmit — clean.
• npx jest — routes/names.integration.test.ts passes (7 tests).
• src/helpers.test.ts fails, but pre-existing and unrelated: verified it fails identically on a clean checkout. Jest does not load .env, so SERVICE_ACCOUNT_KEY is undefined and JSON.parse throws at import in src/setup.ts:30. Left untouched.

Implementation note: in helpers.ts the bare type Response resolves to Express's Response, not fetch's, hence Awaited<ReturnType<typeof fetch>>.

Separately — a deployment lead

#118 removed the zyfiSponsoredUrl: ${...} log from helpers.ts. On current main the only place that string is still logged is testPaymaster.ts, a standalone script. A gateway emitting that line is therefore not running post-#118 code — worth checking whether the deployed build predates 2026-07-08.

[github-actions]

LCOV of commit cf007db during checks #755

Summary coverage rate:
  lines......: 26.9% (939 of 3494 lines)
  functions..: 27.4% (150 of 547 functions)
  branches...: 27.7% (164 of 592 branches)

Files changed coverage rate: n/a