test: 100% coverage for cache, client, grouper (#52)

## Summary
- **cache.go**: 95.7% → 100% (ReadFile error path)
- **grouper.go**: 0%/96% → 100% (added "sses" singularize test, removed
dead code branch in DeriveVerb Case 2)
- **client.go**: 81.6% → 98% (30+ new tests covering OAuth2 edge cases,
pagination auth/connection errors, Fetch error paths, dry-run with
non-JSON body, URL construction edge cases; remaining 2% is structurally
unreachable defensive code)

## Test plan
- [x] `make test` passes
- [x] `make lint` passes
- [x] Coverage verified with `go tool cover`

Author: sofq

gen/grouper.go

@@ -81,11 +81,9 @@ func DeriveVerb(operationID, method, path, resource string) string {
 	// Case 2: rest ENDS with resource name → strip it, keep verb + prefix
 	// e.g., "getAllProjects" → rest=["All","Projects"], resource="project"
 	// → strip "Projects" → prefix = ["All"] → "get-all"
-	if singularize(restSingular[len(rest)-1]) == resourceSingular || restSingular[len(rest)-1] == resourceSingular {
+	// len(rest)==1 is already handled by Case 1, so prefix is never empty here.
+	if len(rest) > 1 && (singularize(restSingular[len(rest)-1]) == resourceSingular || restSingular[len(rest)-1] == resourceSingular) {
 		prefix := restLower[:len(rest)-1]
-		if len(prefix) == 0 {
-			return verb
-		}
 		return verb + "-" + strings.Join(prefix, "-")
 	}
 

gen/grouper_test.go

@@ -136,6 +136,8 @@ func TestSingularizeEdgeCases(t *testing.T) {
 		{"categories", "category"},
 		{"values", "value"},
 		{"project", "project"},
+		// sses suffix branch: strip last 2 chars (e.g. "dresses" → "dress")
+		{"dresses", "dress"},
 	}
 	for _, tt := range tests {
 		t.Run(tt.input, func(t *testing.T) {

internal/cache/cache_test.go

@@ -174,6 +174,40 @@ func TestCacheKeyBackwardCompatible(t *testing.T) {
 	}
 }
 
+// TestGetReadFileError verifies that Get returns (nil, false) when the cache
+// file exists and is fresh but cannot be read (e.g. permissions set to 000).
+// This exercises the os.ReadFile error path in Get (lines 50-53 of cache.go).
+func TestGetReadFileError(t *testing.T) {
+	key := cache.Key("GET", "https://test.example.com/unreadable-"+t.Name())
+
+	// Write a valid cache entry.
+	if err := cache.Set(key, []byte(`{"ok":true}`)); err != nil {
+		t.Fatalf("Set failed: %v", err)
+	}
+
+	// Locate the file and make it unreadable.
+	dir := cache.Dir()
+	path := dir + "/" + key
+	if err := os.Chmod(path, 0o000); err != nil {
+		t.Fatalf("Chmod failed: %v", err)
+	}
+
+	// Restore permissions after the test so cleanup can delete the file.
+	t.Cleanup(func() {
+		_ = os.Chmod(path, 0o600)
+		_ = os.Remove(path)
+	})
+
+	// Get must report a miss because ReadFile fails.
+	data, ok := cache.Get(key, time.Minute)
+	if ok {
+		t.Error("expected cache miss when file is unreadable")
+	}
+	if data != nil {
+		t.Errorf("expected nil data, got %s", data)
+	}
+}
+
 // TestCacheKeyAuthContextIsolation verifies that cached data from one profile
 // is not returned for a different profile.
 func TestCacheKeyAuthContextIsolation(t *testing.T) {