test(providers,zalo): wave A coverage push

Push two deferred packages above their coverage floors:
- internal/providers 57.0% -> 62.2% (+5.2%, target ≥60%)
  Targeted pure-logic adapter transformation code: registry,
  openai/dashscope/codex ToRequest/FromResponse/FromStreamChunk,
  Azure header branch, token source propagation, function_call +
  incomplete + reasoning parse branches.

- internal/channels/zalo 7.2% -> 65.3% (+58.1%, target ≥20%)
  Factory table-driven creds/config cases, New() defaults, callAPI
  success/error/malformed, getMe/getUpdates, sendMessage/sendPhoto,
  Send routing + photo extraction, Stop signal, processUpdate
  dispatch, handleTextMessage empty-sender drop, downloadMedia four
  branches (png/jpg fallback/404/empty).

Minimal refactor: converted package-level apiBase const to var in
internal/channels/zalo/zalo.go so tests can point at httptest server.
Zero runtime behavior change; tests restore the original value via
t.Cleanup.

Ratchet bumps (scripts/coverage_thresholds.json):
- internal/providers: 57.00 -> 62.15
- internal/channels/zalo: 7.20 -> 65.25

Race clean, dual build (default + -tags sqliteonly) clean,
personal/ sub-packages untouched.

scripts/coverage_thresholds.json

@@ -15,7 +15,7 @@
   "internal/channels/telegram/voiceguard": 100,
   "internal/channels/typing": 91.80327868852459,
   "internal/channels/whatsapp": 21.323529411764707,
-  "internal/channels/zalo": 7.203389830508475,
+  "internal/channels/zalo": 65.2542372881356,
   "internal/channels/zalo/personal": 0,
   "internal/channels/zalo/personal/protocol": 19.56989247311828,
   "internal/channels/zalo/personal/zalomethods": 0,
@@ -39,7 +39,7 @@
   "internal/permissions": 98.18181818181819,
   "internal/pipeline": 76.90417690417691,
   "internal/providerresolve": 88.88888888888889,
-  "internal/providers": 56.99965433805738,
+  "internal/providers": 62.15,
   "internal/providers/acp": 0,
   "internal/safego": 100,
   "internal/sandbox": 6.593406593406593,