fix(feishu): harden API client with defensive HTTP status checks (#407)

- Check resp.StatusCode range (2xx) before JSON decoding
- Provide clear actionable errors with HTTP status codes for 5xx failures
- Prevent cryptic JSON parse errors from HTML error pages

internal/channels/feishu/larkclient.go

@@ -68,6 +68,10 @@ func (c *LarkClient) getToken(ctx context.Context) (string, error) {
 	}
 	defer resp.Body.Close()
 
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return "", fmt.Errorf("lark token request failed with HTTP %d", resp.StatusCode)
+	}
+
 	var result struct {
 		Code              int    `json:"code"`
 		Msg               string `json:"msg"`
@@ -150,6 +154,10 @@ func (c *LarkClient) doJSONOnce(ctx context.Context, method, path string, body a
 	}
 	defer resp.Body.Close()
 
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return nil, fmt.Errorf("lark api %s %s: failed with HTTP %d", method, path, resp.StatusCode)
+	}
+
 	var result apiResponse
 	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
 		return nil, fmt.Errorf("lark api decode: %w", err)
@@ -176,6 +184,10 @@ func (c *LarkClient) doDownload(ctx context.Context, path string) ([]byte, strin
 	}
 	defer resp.Body.Close()
 
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return nil, "", fmt.Errorf("lark download %s: failed with HTTP %d", path, resp.StatusCode)
+	}
+
 	// Check for JSON error response
 	ct := resp.Header.Get("Content-Type")
 	if ct != "" {
@@ -244,6 +256,10 @@ func (c *LarkClient) doMultipart(ctx context.Context, path string, fields map[st
 	}
 	defer resp.Body.Close()
 
+	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
+		return nil, fmt.Errorf("lark upload %s: failed with HTTP %d", path, resp.StatusCode)
+	}
+
 	var result apiResponse
 	if err := json.NewDecoder(resp.Body).Decode(&result); err != nil {
 		return nil, fmt.Errorf("lark upload decode: %w", err)