do not print a proxy's error page at somebody

first real test of the settings form returned openresty's 502 Bad Gateway
document, markup and all, into the panel. installing this plugin restarts
officer, and a request made inside that window reaches nginx proxy manager,
finds nothing behind it, and gets a web page back. useClient throws the
response body as the message, so the panel printed it.

worth keeping the irony: this plugin manages the proxy whose error page it
could not read.

the check is the body's SHAPE, not the status, because there is no status that
separates them — api/router.ts uses 502 for "NPM answered and refused", which
is a real answer we must not swallow. ours arrives as a sentence, theirs as a
document. gateway status AND html means the hop in front of officer answered;
html on its own still is not a sentence and says so without the tags.

all three panels go through it now.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Officer-Session: 656f5c85-e49a-4f1f-b9f3-042a04b4d043

web/CertificatesPanel.tsx

@@ -1,6 +1,7 @@
 import { useCallback, useEffect, useRef, useState } from "react";
 import { RefreshCw, ShieldAlert, ShieldCheck } from "lucide-react";
 import { useClient } from "hooks/useClient";
+import { readableError } from "./errors";
 
 /**
  * Certificates, ordered by how soon they expire.
@@ -38,7 +39,7 @@ export const CertificatesPanel = () => {
     } catch (caught) {
       // Not `.body` — `useClient` throws `ApiError(status, message)` and has no body. See `asFailure` in
       // HostsPanel.tsx for the full account; this panel had the same dead read.
-      setError(caught instanceof Error ? caught.message : "Could not load certificates.");
+      setError(readableError(caught, "Could not load certificates."));
       setCertificates(null);
     }
   }, []);