clef-proxy: invalid client JSON returns 500 instead of 400 — body parse shares the upstream try/catch, non-JSON upstream is masked, and there are no tests #690

Problem

bin/clef-proxy.mjs is the only bin proxy whose client-body parse shares one try/catch with the upstream call, so a client error is reported as a server error:

• bin/clef-proxy.mjs:115-157 — JSON.parse(bodyText) sits inside the same try as the Cloudflare fetch, and the single catch at :154-156 always answers 500.
• Verified live on main (4f905d7): POST /v1/systemone with body not-json{ returns 500 {"error":"Unexpected token 'o', \"not-json{\" is not valid JSON"}. Every sibling proxy returns 400 for the same input (e.g. muse-proxy.mjs, codex-proxy.mjs, agy-proxy.mjs, antigravity-ls-proxy.mjs all parse in a dedicated try and answer 400).
• Same catch also swallows upstream-shape errors: if the Cloudflare gateway returns a non-JSON body (e.g. an HTML 502/429 page), await cfRes.json() at :142 throws and the client gets a bare 500 with a JSON-parse message, losing the upstream status. If the upstream body parses to null, cfData.success at :144 throws a TypeError down the same path.

bin/clef-proxy.mjs also has no test file at all — every other bin proxy has one (muse-proxy.test.mjs, codex-proxy.test.mjs, agy-proxy via its suite, design-code-proxy.test.mjs, antigravity-ls-proxy.test.mjs, proxy-port.test.mjs).

Why it matters

Clients (and OpenCode's error handling) treat 400 and 500 differently: a malformed request reported as 500 looks like a proxy outage, invites retries of a request that can never succeed, and hides real upstream failures behind a parse-error message with the wrong status.

Acceptance criteria

• POST /v1/systemone with a non-JSON body returns 400 (matching the sibling proxies), with the parse error in the body.
• A non-JSON upstream response does not surface as a client-facing JSON-parse 500; it is reported as an upstream failure preserving the upstream status (or 502).
• A null/non-object upstream JSON body does not throw on cfData.success.
• New bin/clef-proxy.test.mjs (run: node --test bin/clef-proxy.test.mjs) covers at least: health, invalid JSON → 400, missing token → 401. The 400 test fails on the pre-fix code.