docs(core): correct why authFetch tolerates a non-JSON body

[Bccorb]

Follow-up to fells-code/seamless-auth-api#244 (closing fells-code/seamless-auth-api#241), which made a 429 answer the JSON error shape.

Answering the question that prompted this: no, the shim cannot go

The ask was to remove makeJsonTolerant once the 429 was fixed. It is not safe, and this PR makes the code say why instead.

The comment currently reads:

Upstream responses aren't always JSON: a rate-limited request comes back as plain text ("Too many requests…") and a 204 has no body.

The first half is no longer true. Leaving it there is worse than saying nothing, because the next reader checks the stated reason, finds it fixed, and concludes the shim is dead code.

Two reasons survive:

1. A 204 has no body. GET /magic-link/check answers 204 while a link is unconfirmed. pollMagicLinkConfirmationHandler guards that status explicitly, but the tolerance is what makes the guard optional rather than mandatory at 24 call sites.
2. The API sits behind a load balancer. A 502 or a gateway timeout is that proxy's HTML error page, produced without the API being involved at all. No change upstream can prevent it, because the API never sees the request.

I checked all 24 .json() call sites in core. Every one parses a body before checking the status, so any of them would throw on either case. After the 429 fix, every response the API itself produces is JSON, and the API's only 204s are both in pollMagicLinkConfirmation, so reason 1 is narrow. Reason 2 is not, and is outside anyone's control here.

What changed

• The comment, replaced with the two reasons that hold plus a note that the rate-limit case is fixed and removed a reason rather than the shim.
• The test that pinned the non-JSON path was named "e.g. a 429" and asserted on "Too many requests…". After #244 that is the one status that can no longer produce a non-JSON body, so the test was anchored on an example that had stopped being an example. Re-anchored on a 502 HTML error page.

No behaviour change. makeJsonTolerant is untouched and no changeset is needed.

Verification

pnpm build clean, pnpm test at the workspace root: core 231, express 154, fastify 48, all passing.