net.http: bring H2Conn.read_response to response-validation parity with the mux path

The synchronous client validated far less of a server response than the
multiplexed H2MuxConn.on_response_headers/on_response_data path, so a malformed
server could hang the request or have a bogus response accepted. Close the gaps,
matching the mux path (which already enforces each of these):

- Trailers (a second HEADERS block) must carry END_STREAM (RFC 9113 §8.1).
  Previously a trailers frame without END_STREAM fell through and read_response
  looped in next_frame() forever.
- :status must be present and in range; 101 is forbidden in HTTP/2 (§8.1.1,
  §8.3.1). Previously a sub-100 or >599 status was latched as a valid response,
  and 101 was treated as a 1xx interim, waiting forever for a "final" HEADERS.
- DATA before the first response HEADERS is a protocol error (§8.1). Previously
  body bytes were delivered with status 0.

The 1xx + END_STREAM rejection added in the previous commit is retained. Each
guard fails the request (abandoning the connection) rather than hanging or
returning a malformed response, consistent with the existing error returns in
read_response. Surfaced while reviewing the 1xx fix for #27413.

Co-Authored-By: WOZCODE <contact@withwoz.com>

Author: quaesitor-scientiam

vlib/net/http/h2_conn.v

@@ -200,19 +200,44 @@ fn (mut c H2Conn) read_response(stream_id u32, req H2ClientRequest) !H2ClientRes
 				fragment := c.collect_header_block(frame.fragment, frame.end_headers, stream_id)!
 				// Decode once — HPACK table state is advanced here.
 				decoded := c.decoder.decode(fragment)!
-				// First pass: find :status to detect 1xx informational responses
-				// (RFC 7540 §8.1, RFC 7231 §6.2). Trailers have no :status (== 0).
+				if got_headers {
+					// A second HEADERS block carries trailers, which MUST end the
+					// stream (RFC 9113 §8.1). Without END_STREAM read_response would
+					// loop forever waiting for a stream end that never comes; the mux
+					// path resets such a stream, so the synchronous client fails too.
+					if !frame.end_stream {
+						return error('h2: trailers HEADERS frame must carry END_STREAM')
+					}
+					for f in decoded {
+						if !f.name.starts_with(':') {
+							resp.headers << f
+						}
+					}
+					break
+				}
+				// First (interim or final) response HEADERS. Find :status. A
+				// response MUST carry a valid :status (RFC 9113 §8.3.1), and 101 is
+				// forbidden in HTTP/2 (§8.1.1).
 				mut status := 0
+				mut status_seen := false
 				for f in decoded {
 					if f.name == ':status' {
 						if f.value.len == 3 && all_digits(f.value) {
 							status = f.value.int()
 						} else {
 							return error('h2: malformed :status value: ${f.value}')
 						}
+						status_seen = true
 						break
 					}
 				}
+				if !status_seen || status < 100 || status > 599 || status == 101 {
+					// Missing / out-of-range / 101 status: fail rather than latch a
+					// bogus status or (for 101 or a sub-200 interim) loop forever
+					// waiting for a "final" HEADERS. Mirrors the mux path, which
+					// resets the stream with PROTOCOL_ERROR.
+					return error('h2: response with a missing or invalid :status: ${status}')
+				}
 				if status >= 100 && status < 200 {
 					// 1xx informational: discard and continue waiting for the
 					// final HEADERS block. Do not set got_headers here.
@@ -227,17 +252,12 @@ fn (mut c H2Conn) read_response(stream_id u32, req H2ClientRequest) !H2ClientRes
 					}
 					continue
 				}
-				// Second pass: populate the response. Skip pseudo-headers.
-				if status > 0 {
-					resp.status = status
-				}
+				// Final response (status >= 200): populate, skipping pseudo-headers.
+				resp.status = status
 				for f in decoded {
 					if !f.name.starts_with(':') {
 						resp.headers << f
-						// Only update body_expected on the first (non-1xx) HEADERS
-						// frame. A content-length field in a trailer must not
-						// overwrite the value used for the completeness check below.
-						if !got_headers && f.name == 'content-length' {
+						if f.name == 'content-length' {
 							if all_digits(f.value) {
 								body_expected = f.value.u64()
 								has_content_length = true
@@ -256,6 +276,12 @@ fn (mut c H2Conn) read_response(stream_id u32, req H2ClientRequest) !H2ClientRes
 				if frame.stream_id != stream_id {
 					continue
 				}
+				if !got_headers {
+					// DATA before the response HEADERS is a protocol error
+					// (RFC 9113 §8.1); the mux path rejects it. Fail rather than
+					// deliver body bytes for a response that has no status yet.
+					return error('h2: DATA frame before response HEADERS')
+				}
 				if frame.data.len > 0 {
 					body_so_far += u64(frame.data.len)
 					// Append the chunk to the response body unless the copy