fix(core): return a code instead of an empty response for an empty failure body

[Bccorb]

Closes #125.

Problem

The auth-flow routes forward the auth API's failure body rather than interpreting it. An empty body left nothing to forward, so the caller got a bare 4xx with no content:

Route	Before
POST /login	(empty)
GET /oauth/providers	(empty)
PATCH /admin/users/:id	{"error":"admin_request_failed"}

The proxy routes already had a fallback via readUpstreamFailure, so the two families disagreed on precisely the case where the caller has least to go on. Downstream, toSeamlessAuthError in seamless-auth-react reads the body for a message, finds none, and uses the per-call fallback string, so the user sees a generic failure whether the session expired, the request was rate limited, or the API was down.

Fix

readPassthroughFailure(data, fallback?) forwards the body when there is one and returns a code when there is not. The auth-flow handlers now route through it.

Verified end to end against a running adapter:

empty 400 body         400 {"error":"upstream_error"}
normal error body      400 {"error":"account_locked"}
oauth sibling code     400 {"error":"oauth_profile_error","code":"oauth_email_not_verified"}
rate-limit text body   400 {"message":"Too many requests."}

Only the first line changes. A present body is still forwarded untouched, including the top-level code the React SDK reads to tell OAuth failures apart, which is the constraint that shaped the errorBody contract in the first place.

Note the rate-limit row: a non-JSON body is not empty here, because authFetch already turns plain text into { message: text }. Only a genuinely empty body hits the fallback.

New exports

readPassthroughFailure and UPSTREAM_ERROR_CODE, both from @seamless-auth/core.

Tests

• packages/core/tests/passthroughFailure.test.js: four body shapes forwarded untouched, four empty-ish values falling back, a caller-supplied fallback, and the invariant that a result never carries both an errorBody and an errorCode.
• One case added to the Express failureWireFormat guard, so the wire shape is locked alongside the others.

Checks

pnpm build clean. pnpm test passes: 372 tests across the three packages.