fix(web): reacquire clearance after image challenge 403

[2164312714-svg]

Summary

• classify empty/HTML/Cloudflare-style media 403 responses separately from structured JSON policy responses
• release and reacquire the Grok Web lease before one bounded retry for Lite Gateway and Quality Imagine WebSocket image generation
• invalidate Clearance for anti-bot errors delivered inside a successful Lite stream
• retry the complete image-edit media flow once so upload, Media Post, and generation use the refreshed browser session
• preserve bounded, redacted upstream diagnostics and return a normalized provider response after retry exhaustion
• map HTTP test base URLs to ws:// while preserving HTTPS to wss://

Structured moderation or permission responses do not enter the Clearance retry loop.

Tests

• go test ./internal/infra/provider/web
• go test ./...
• regression coverage for:
  • challenge vs structured JSON 403 classification
  • bounded provider error responses
  • Quality Imagine WebSocket first-handshake 403 followed by success
  • Lite Gateway WebSocket first-handshake 403 followed by success

Closes #932