proxmox: thin HTTP client, seam, log decorator and in-memory fake

httpAPI implements the sixteen seam methods over net/http: the token is
read per request, non-2xx answers become apiError from the body message or
the reason phrase, echoed secrets are redacted, the CA loads lazily, HTTP/2
is off, and uploads stream with an exact Content-Length. The observed
decorator logs one V(1) line per call and starts no span; New wires both.
fakeAPI simulates clone locks, tasks and ISOs with the captured error texts.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

internal/provider/proxmox/proxmox_test.go

@@ -95,6 +95,31 @@ func TestNew_nilBlockDoesNotPanic(t *testing.T) {
 	}
 }
 
+// TestNew_wiresObservedHTTPClient checks that production calls go through
+// the logging decorator to the HTTP client, with /api2/json appended and
+// the request timeout from the config.
+func TestNew_wiresObservedHTTPClient(t *testing.T) {
+	t.Parallel()
+	ctx, _ := captureContext()
+	cfg := testConfig()
+	cfg.RequestTimeoutSeconds = 45
+	p, err := New(ctx, provider.ProviderConfig{Name: "proxmox-home", Type: "proxmox", Proxmox: &cfg})
+	if err != nil {
+		t.Fatalf("New() error = %v", err)
+	}
+	o, ok := p.(*Provider).api.(*observed)
+	if !ok {
+		t.Fatalf("api = %T, want *observed", p.(*Provider).api)
+	}
+	h, ok := o.inner.(*httpAPI)
+	if !ok {
+		t.Fatalf("observed.inner = %T, want *httpAPI", o.inner)
+	}
+	if o.provider != "proxmox-home" || h.base.String() != "https://192.0.2.8:8006/api2/json" || h.timeout != 45*time.Second || h.tokenFile != cfg.TokenFile {
+		t.Errorf("wiring = provider %q base %q timeout %v token file %q", o.provider, h.base, h.timeout, h.tokenFile)
+	}
+}
+
 func TestWithDefaults_table(t *testing.T) {
 	t.Parallel()
 	off := false