Fall through sharedPrefetch when proxy returns non-2xx

Joe says: What Claude says below is accurate, no more notes on functionality

Emmanuel had reported an issue with loading shared images and shared programs
on pyret.bootstrapworld.org.

There was indeed a problem where the proxy for shared URLs could report
failures *from the proxy* when the file had actually been published or added on
PBO. This fixes that issue with the "proxy back to CPO for legacy share URLs"
feature.

Claude says:

The /shared-image-contents, /shared-program-contents, and /shared-file
endpoints try the SHARED_FETCH_SERVER proxy first and fall back to a
local Drive fetch on failure. sharedPrefetch was resolving on any HTTP
response from the upstream, including 4xx, which meant the upstream's
error body got piped straight back to the client — the local fallback
never ran.

For shares minted on this deploy and unknown to the proxy server (e.g.,
PBO or pyret-horizon proxying through CPO), this turned every fetch into
a 400 "Could not access shared file" instead of falling through to the
local fetch where it would have succeeded.

Only resolve sharedPrefetch on 2xx; abort the in-flight request and
reject otherwise, so the existing .fail handlers do their job.

Author: jpolitz

src/server.js

@@ -861,7 +861,19 @@ function start(config, onServerReady) {
     if(config.sharedFetchServer) {
       let response = request({url: url});
       response.on("error", (error) => { ret.reject(error); });
-      response.on("response", (resp) => ret.resolve(response));
+      response.on("response", (resp) => {
+        // Only treat 2xx as a real proxy hit. A 4xx from the upstream
+        // (e.g. when the shared id was minted on *this* deploy and the
+        // proxy server has no record of it) must fall through to the
+        // local Drive fetch — otherwise the upstream error body gets
+        // piped straight back to the client.
+        if (resp.statusCode >= 200 && resp.statusCode < 300) {
+          ret.resolve(response);
+        } else {
+          response.abort();
+          ret.reject("Proxy returned status " + resp.statusCode);
+        }
+      });
     }
     else  {
       ret.reject("No fallback server configured");