Start refusal: read headers only so the 4 KiB bound limits the read; narrow the swallow to non-cancellation

Soul re-pass on 87a1bb6b: PostAsJsonAsync buffered the whole body before the cap applied. Test renamed to say what it pins.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

src/Bifrost.Web/Features/Heimdall/HeimdallAuthService.cs

@@ -83,7 +83,7 @@ public sealed class HeimdallAuthService(
                 detail += ", " + code;
             }
         }
-        catch (Exception) when (!cancellationToken.IsCancellationRequested)
+        catch (Exception error) when (error is not OperationCanceledException)
         {
         }
 
@@ -121,10 +121,12 @@ public sealed class HeimdallAuthService(
             new HeimdallHandoff("browser_completion"),
             entitlementPolicy);
 
-        var response = await httpClient.PostAsJsonAsync(
-            $"/v1/oauth/{provider}/start",
-            request,
-            cancellationToken);
+        // Headers only: a refusal body is read through RefusedStartMessageAsync's own 4 KiB bound, not buffered whole.
+        using var startMessage = new HttpRequestMessage(HttpMethod.Post, $"/v1/oauth/{provider}/start")
+        {
+            Content = JsonContent.Create(request)
+        };
+        using var response = await httpClient.SendAsync(startMessage, HttpCompletionOption.ResponseHeadersRead, cancellationToken);
 
         if (!response.IsSuccessStatusCode)
         {

tests/Bifrost.Web.Tests/HeimdallCompletionTests.cs

@@ -1172,7 +1172,7 @@ public sealed class HeimdallCompletionTests
     [InlineData("text/html; charset=windows-1252")]
     [InlineData("text/html; charset=bogus")]
     [InlineData("text/html; charset=utf-7")]
-    public async Task A_refusal_whose_body_cannot_be_decoded_still_redirects_with_the_status(string contentType)
+    public async Task A_refusal_with_an_unusual_charset_still_redirects_with_the_status(string contentType)
     {
         using var host = new HeimdallHost();
         host.Heimdall.StartStatus = HttpStatusCode.BadGateway;