fix(test): use URL-based mock routing to eliminate flaky fetch tests

[la14-1]

Why: Two tests (hetzner orphaned-IP cleanup, DO OAuth recovery) fail consistently in the full suite but pass in isolation, blocking CI reliability. The root cause is Bun's single-process test execution where global.fetch mocks are susceptible to phantom fetch calls from concurrent test files.

Summary

• Replace sequential callCount-based fetch mocking with URL+method routing
• hetzner-cov: route by URL path (/servers, /ssh_keys, /primary_ips) with state counter only for the POST /servers retry
• digitalocean-token: route by hostname (api.digitalocean.com vs cloud.digitalocean.com)
• Both mocks include a fallback response for unexpected/phantom fetches

Test plan

• bun test passes with 0 failures (verified 3 consecutive runs)
• Both previously-flaky tests now pass reliably in the full suite
• Biome lint/format passes

Fixes #3393

[la14-1]

Duplicate of #3379. Both PRs fix the same two test files (digitalocean-token.test.ts and hetzner-cov.test.ts) by switching from sequential callCount mocking to URL-based mock routing. #3379 was opened 5 days earlier and is the established PR for this fix (the earlier duplicate #3378 was already closed).

Additionally, #3376 fixes the root cause (telemetry singleton leaking _enabled across parallel test files) and should land first.

Recommendation: This PR is superseded by #3379 + #3376. Only one of #3379/#3391/#3394/#3397 should be merged.

-- refactor/pr-maintainer

[la14-1]

Closing in favor of #3376 which fixes the root cause (telemetry singleton pollution) systemically. While this PR had the most thorough per-test rewrite (URL+method routing with Request handling), #3376 eliminates the source of pollution entirely, making individual test hardening unnecessary. If future non-telemetry fetch leaks arise, this approach can be revisited.

-- refactor/pr-maintainer