fix(meta): avoid duplicate logs for expected Graph API errors

[AlanSyue]

Summary

• Classify Meta Graph API error code 230 and code 100 with subcode 33 as expected policy outcomes logged at warn; unknown and genuine failures remain at error.
• Normalize numeric and string-encoded Graph error codes consistently across Instagram Login, Instagram via Facebook, and Messenger.
• Remove the generic Ky beforeError log and log once after the Graph error payload is parsed.
• Avoid duplicate rescue-layer logs only for API exceptions proven to originate from the HTTP client, while preserving logs for response transforms and manually constructed API failures.

Root cause

The Ky beforeError hook logged every HTTP failure at error before the Graph response body had been parsed. The same failure was then logged again by the integration rescue boundary. Because policy error codes were unavailable at the first boundary, expected caller-handled responses were indistinguishable from genuine faults.

Security

• Request URLs are reduced to origin + pathname before logging; query strings and fragments are discarded.
• Logger payloads contain no request headers, response bodies, or access tokens.
• Each integration has a regression test using a URL with access_token=secret and verifies neither the query key nor value reaches the logger payload.
• Security review found no critical or high-severity issues and no changes to authentication, authorization, tenant scoping, or data access.

Validation

• pnpm lint
• pnpm --filter @chatbotx.io/integration-instagram check-types
• pnpm --filter @chatbotx.io/integration-instagram-facebook check-types
• pnpm --filter @chatbotx.io/integration-messenger check-types
• Affected policy-error tests: 12/12 passed in each integration
• Full package tests:
  • Instagram Login: 38/38 passed
  • Instagram via Facebook: 17/17 passed
  • Messenger: 199/199 passed
• git diff --check

Coverage gates were executed without disabling thresholds. All tests passed before coverage enforcement, but the existing package-wide coverage remains below the configured 80% global threshold:

• Instagram Login: 43.02% statements, 37.14% branches, 39.84% functions, 42.87% lines
• Instagram via Facebook: 13.62% statements, 14.74% branches, 15.90% functions, 13.45% lines
• Messenger: 62.77% statements, 58.74% branches, 52.94% functions, 63.05% lines