test: replace duplicate User-Agent test with skipAuth blob path coverage

Second test now verifies User-Agent is set on unauthenticated blob requests
(skipAuth=true) and that Authorization header is absent on those calls.

Closes #16

Agent-Logs-Url: https://github.com/Azure/apiops-cli/sessions/7d507051-7b27-4f36-b053-acc897e40ecc

Co-authored-by: petehauge <12090616+petehauge@users.noreply.github.com>

Author: Copilot

tests/unit/clients/apim-client.test.ts

@@ -1163,24 +1163,24 @@ describe('User-Agent header', () => {
     expect(headers.get('User-Agent')).toMatch(/^apiops-cli\/\d+\.\d+\.\d+/);
   });
 
-  it('should include User-Agent header with correct format', async () => {
+  it('should include User-Agent header on unauthenticated (skipAuth) blob requests', async () => {
+    // First fetch: authenticated APIM call returns an openapi-link SAS URL
     fetchSpy.mockResolvedValueOnce(
-      makeResponse(200, {
-        value: [{ name: 'api-1' }],
-      })
+      makeResponse(200, { link: 'https://example.blob.core.windows.net/spec.json?sig=abc' })
+    );
+    // Second fetch: unauthenticated blob download (skipAuth=true)
+    fetchSpy.mockResolvedValueOnce(
+      new Response('openapi: 3.0.0', { status: 200, headers: { 'Content-Type': 'text/plain' } })
     );
 
-    const results: unknown[] = [];
-    for await (const item of client.listResources(testContext, ResourceType.Api)) {
-      results.push(item);
-    }
+    await client.getApiSpecification(testContext, 'test-api');
 
-    expect(fetchSpy).toHaveBeenCalledTimes(1);
-    const [_url, init] = fetchSpy.mock.calls[0] as [string, RequestInit];
-    const headers = new Headers(init?.headers);
-    const userAgent = headers.get('User-Agent');
-    expect(userAgent).toBeTruthy();
-    expect(userAgent).toContain('apiops-cli/');
-    expect(userAgent).toMatch(/\d+\.\d+\.\d+/);
+    // The second call is the skipAuth blob fetch — verify it still carries User-Agent
+    expect(fetchSpy).toHaveBeenCalledTimes(2);
+    const [_blobUrl, blobInit] = fetchSpy.mock.calls[1] as [string, RequestInit];
+    const blobHeaders = new Headers(blobInit?.headers);
+    expect(blobHeaders.get('User-Agent')).toMatch(/^apiops-cli\/\d+\.\d+\.\d+/);
+    // Authorization must NOT be set on the unauthenticated call
+    expect(blobHeaders.get('Authorization')).toBeNull();
   });
 });