PostIt/Yavsc.Blogs: surface 4xx body + pin controller + red UI test for Save

The 'Save' button in PostIt has been returning 400 from
/api/v1/blog ever since the editor's title and article fields
were re-bound to SelectedPost.Title / SelectedPost.Article.
The user types into the editor, taps Save, the controller
rejects with 'The Title field is required', and the PostIt
status bar shows only the generic 'Response status code does
not indicate success: 400' — no field name, no reason.

Three pieces here make the regression diagnosable and pin a
test for the fix:

1. YavscApiClient: replace EnsureSuccessStatusCode() at both
   call sites with a small helper that reads the response
   body and embeds it in the thrown HttpRequestException. The
   VM's existing catch (Exception) in ExecuteAsync forwards
   ex.Message to the status bar, so the next 'click Save'
   tells the user exactly which field the server rejected.

2. Yavsc.Blogs.Tests: two integration tests on the real
   controller (no HTTP mock) — one pins that a well-formed
   PostIt-shaped payload (Title + Article + AuthorId + dates,
   Id=0) is accepted with 201, the other pins that a payload
   with Title=string.Empty is rejected with 400. Together they
   pin the contract the VM has to honour.

3. PostIt.Tests: a red [AvaloniaFact] UI test that mounts
   MainPage inside a headless Window, types a title into the
   TextBox without first selecting a post in the list, taps
   Save, and asserts the body of the first POST contains
   the typed title. Today this test fails with Title='',
   reproducing the production 400. The matching fix (a
   Title/Article buffer on MainPageViewModel that the XAML
   binds to, and that Save uses to build the outgoing
   BlogPost) is the next commit; the test is the safety net.

src/PostIt/PostIt/Services/YavscApiClient.cs

@@ -191,7 +191,7 @@ public class YavscApiClient : IAsyncDisposable
         CancellationToken ct = default)
     {
         using var response = await SendAsync(method, path, body, ct).ConfigureAwait(false);
-        response.EnsureSuccessStatusCode();
+        await EnsureSuccessOrThrowAsync(response, ct).ConfigureAwait(false);
 
         var stream = await response.Content.ReadAsStreamAsync(ct).ConfigureAwait(false);
         var dto = await JsonSerializer.DeserializeAsync<T>(stream,
@@ -217,7 +217,7 @@ public class YavscApiClient : IAsyncDisposable
         CancellationToken ct = default)
     {
         using var response = await SendAsync(method, path, body, ct).ConfigureAwait(false);
-        response.EnsureSuccessStatusCode();
+        await EnsureSuccessOrThrowAsync(response, ct).ConfigureAwait(false);
     }
 
     /// <summary>
@@ -259,6 +259,48 @@ public class YavscApiClient : IAsyncDisposable
         return response;
     }
 
+    /// <summary>
+    /// Replaces the bare <c>response.EnsureSuccessStatusCode()</c>
+    /// call site with one that surfaces the response body in the
+    /// thrown exception. The default behaviour truncates the
+    /// diagnostic to "Response status code does not indicate
+    /// success: 400 (Bad Request)." — useless when the server is
+    /// an ASP.NET Core action returning a <c>ProblemDetails</c>
+    /// that names the field that failed ModelState validation.
+    /// The VM's <c>catch (Exception ex)</c> in
+    /// <c>MainPageViewModel.ExecuteAsync</c> shows
+    /// <c>ex.Message</c> on the status bar, so embedding the body
+    /// here is enough to make the next "click Save" self-explanatory
+    /// (e.g. <i>"Error: 400 — The Title field is required."</i>).
+    /// </summary>
+    private static async Task EnsureSuccessOrThrowAsync(HttpResponseMessage response, CancellationToken ct)
+    {
+        if (response.IsSuccessStatusCode) return;
+
+        // Read the body before throwing; once the response is
+        // disposed, the stream is gone. We bound the read to a few
+        // KB so a hostile server can't make us buffer megabytes
+        // just to format an error message.
+        string body = string.Empty;
+        try
+        {
+            var raw = await response.Content.ReadAsStringAsync(ct).ConfigureAwait(false);
+            if (!string.IsNullOrWhiteSpace(raw))
+            {
+                body = raw.Length > 1024 ? raw[..1024] + "…" : raw;
+            }
+        }
+        catch
+        {
+            // Body unreadable: fall back to the default message.
+        }
+
+        var msg = body.Length > 0
+            ? $"{(int)response.StatusCode} {response.ReasonPhrase}: {body}"
+            : $"{(int)response.StatusCode} {response.ReasonPhrase}";
+        throw new HttpRequestException(msg, inner: null, statusCode: response.StatusCode);
+    }
+
     /// <summary>
     /// Lock the refresh path so concurrent callers don't each rotate
     /// the refresh token (which Auth0 invalidates on first use).