fix(aas): honor HTTP_PROXY/HTTPS_PROXY during API key validation

[nina9753]

Summary

• Root cause: validateApiKey() in packages/base/src/helpers/apikey.ts called httpRequest without a dispatcher, so undici's fetch ignored HTTP_PROXY/HTTPS_PROXY. Behind a corporate proxy this caused an ECONNRESET, which was then caught by a blanket catch in instrument.ts and mislabeled as "Invalid API Key".
• Fix: Pass getProxyDispatcher('') (which returns an EnvHttpProxyAgent reading proxy env vars) into the validateApiKey httpRequest call — the same pattern already used by getRequestBuilder elsewhere in the codebase.
• Better error message: Split the instrument.ts catch block so a network/proxy failure reports a clear "network error" message with a hint to check HTTP_PROXY/HTTPS_PROXY, instead of the misleading "Invalid API Key" message.

Fixes: SLES-2940

Test plan

• yarn build — clean
• yarn test packages/plugin-aas/src/__tests__/instrument.test.ts — passes, including new test for the network-error path
• Manual: HTTP_PROXY=http://localhost:9 DD_API_KEY=<valid> DD_SITE=datadoghq.com yarn launch aas instrument --resource-id ... → shows "network error" (proxy used, localhost:9 not listening)
• Manual: DD_API_KEY=<valid> DD_SITE=datadoghq.com yarn launch aas instrument --resource-id ... → passes API key validation, proceeds to Azure auth (no regression)

🤖 Generated with Claude Code

[datadog-official]

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 1caeef5 | Docs | Datadog PR Page | Give us feedback!}

[ava-silver]

two quick things before i approve!

[ava-silver]

Could we add a base helper test that calls the real validateApiKey() and asserts that its httpRequest receives an EnvHttpProxyAgent dispatcher? The existing AAS test should remain because it covers the user-facing network error, but it mocks validateApiKey() and therefore does not verify the proxy wiring itself.

for example:

   test('API key validation uses the environment proxy dispatcher', async () => {
     const httpRequest = jest.spyOn(request, 'httpRequest').mockResolvedValue({
       config: {},
       data: {valid: true},
       headers: {},
       status: 200,
       statusText: 'OK',
     })

     const validator = newApiKeyValidator({
       apiKey: 'api-key',
       datadogSite: 'datadoghq.com',
     })

     await expect(validator.validateApiKey()).resolves.toBe(true)

     expect(httpRequest).toHaveBeenCalledWith(
       expect.objectContaining({
         baseURL: 'https://api.datadoghq.com',
         dispatcher: expect.any(EnvHttpProxyAgent),
       })
     )
   })

[nina9753]

Good call added packages/base/src/helpers/__tests__/apikey.test.ts which spies on httpRequest directly and asserts an EnvHttpProxyAgent is passed, plus covers the 403, network error, and empty key cases.

[ava-silver]

one nit on wording but overall lgtm