proxmox: thin HTTP client, seam, log decorator and in-memory fake

httpAPI implements the sixteen seam methods over net/http: the token is
read per request, non-2xx answers become apiError from the body message or
the reason phrase, echoed secrets are redacted, the CA loads lazily, HTTP/2
is off, and uploads stream with an exact Content-Length. The observed
decorator logs one V(1) line per call and starts no span; New wires both.
fakeAPI simulates clone locks, tasks and ISOs with the captured error texts.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

docs/proxmox-provider-spec.md

@@ -696,8 +696,9 @@ named `proxmox`, with `provider` on every line and `vmid`, `name` and
   `proxmox vm fetched` with state, ip and uid, `proxmox vm deleted`,
   `proxmox vms listed` with counts, `proxmox node checked` with the reason),
   one `proxmox api call` line per seam call from the decorator (`call`,
-  `node`, `vmid`, `storage`, `upid`, `duration`, and on failure
-  `httpStatus` and `error`), a `proxmox task failed` line with the UPID and
+  `node`, `vmid`, `storage`, `upid`, `duration`, plus `newid` and `name`
+  on a clone, `filename` on an upload and `volid` on a volume delete, and
+  on failure `httpStatus` and `error`), a `proxmox task failed` line with the UPID and
   `exitstatus`, and the no-op lines of Delete and ListByTag (foreign VM
   left alone, unreadable candidate skipped).
 - V(2): request parameters (without `description`'s content at V(1) and