lfx api: no test coverage for runAPI's request/response handling

[emsearcy]

Summary

internal/commands/api_test.go only covers lfx api's pure/testable
helper functions (coerceFieldValue, apiJoinURL, apiHasExplicitBody,
apiRequestBody). The runAPI function itself -- which wires those
helpers together into an actual HTTP request/response cycle -- has no
test coverage.

Behavior currently only exercised manually / by inspection includes:

• Method resolution and the GET-to-POST auto-promotion when a body is
  explicitly supplied via --field/--raw-field/--input.
• Authorization header injection from the resolved access token, and
  interaction with user-supplied -H/--header values (including
  whether a user-supplied header can override the injected one).
• -q/--query response filtering via gjson.
• Non-2xx response handling (exit code and diagnostic output).
• --hostname overriding the audience-derived base URL.

Context

Raised during review of #6 (implementing lfx api):
#6 (comment)

Note

This issue intentionally does not prescribe an approach (e.g.
httptest.Server, a mockable HTTP client/transport, or something else)
-- left to whoever picks this up.