refactor(cli/http): replace ky with a self-contained HTTP client

[lin-snow]

Summary

Replace the CLI's ky-based HTTP layer with a small, self-contained client and migrate every call site to it. Internal transport refactor — no behavioral change to CLI commands.

Dependency-wise this swaps the ky HTTP wrapper for undici (the engine that already powers Node's fetch), pulled in for one reason: honoring HTTP_PROXY / HTTPS_PROXY / NO_PROXY via EnvHttpProxyAgent (Node's global fetch silently ignores them). It is externalized at build, not bundled.

flowchart LR
  subgraph Before
    A["~30 call sites"] -->|"KyInstance leak"| K["ky + middleware/"]
  end
  subgraph After
    B["~30 call sites"] --> H["createHttpClient → HttpClient"]
    H --> D["recursive dispatch + fetch + hooks"]
    D --> P["proxy dispatcher (EnvHttpProxyAgent)"]
  end

Loading

HttpClient surface

Method	Returns	Notes
get / post / put / patch / delete<T>	Promise<T>	typed JSON, throws on non-2xx; 204/empty body → undefined
fetch	Promise<Response>	raw Response (OAuth)
stream	Promise<Response>	SSE — no retry / no timeout
extend	HttpClient	re-run factory with merged opts

cli/src/http/ ships focused, unit-tested modules: url (query building), body (encoding), retry (policy), hooks (lifecycle), proxy (env-driven proxy dispatcher), types (contract). Auth / UA / logging / error-classification are composable hooks compiled in at construction; AbortSignal.any([user, timeout]) replaces the old timing cast and the { throwHttpErrors: false, skipClassify } escape hatch. The middleware/ layer and the ky dependency are removed; testHttpClient dedupes client setup across the suite.

Proxy support

proxyDispatcher() resolves a single EnvHttpProxyAgent once per process when a proxy env var is present and passes it as the per-request dispatcher; with no proxy var set, fetch keeps its default dispatcher untouched. Routing was verified end-to-end (dead-proxy → connection refused at the proxy) on both Node (via the dispatcher) and the bun build --compile binary (native proxy support + dispatcher, no regression).

Verification

Check	Result
pnpm test	87 files / 893 tests pass
pnpm type-check + pnpm lint	clean
ky / KyInstance refs in cli/src	none
proxy routing (Node + bun binary)	honored

Screenshots

N/A — internal refactor, no user-facing UI change.

Checklist

• This change requires a documentation update, included: Dify Document
• I understand that this PR may be closed in case there was no previous discussion or issues. (This doesn't apply to typos!)
• I've added a test for each change that was introduced, and I tried as much as possible to make a single atomic change.
• I've updated the documentation accordingly.
• I ran cd cli && pnpm type-check && pnpm lint && pnpm test to appease the lint gods