fix: keep proxy slot through response body

internal/webdevice/proxy_test.go

@@ -1,6 +1,7 @@
 package webdevice
 
 import (
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"net/url"
@@ -148,6 +149,44 @@ func TestProxyHTTPClosesUpstreamConnection(t *testing.T) {
 	}
 }
 
+func TestRetryTransportHoldsProxySlotUntilBodyClose(t *testing.T) {
+	limiter := make(chan struct{}, 1)
+	transport := retryTransport{
+		base: roundTripperFunc(func(req *http.Request) (*http.Response, error) {
+			return &http.Response{
+				StatusCode: http.StatusOK,
+				Body:       io.NopCloser(strings.NewReader("ok")),
+				Header:     http.Header{},
+				Request:    req,
+			}, nil
+		}),
+		limiter:        limiter,
+		attempts:       1,
+		acquireTimeout: time.Second,
+	}
+
+	req := httptest.NewRequest(http.MethodGet, "http://portal/test", nil)
+	resp, err := transport.RoundTrip(req)
+	if err != nil {
+		t.Fatalf("RoundTrip() error = %v", err)
+	}
+	if got := len(limiter); got != 1 {
+		t.Fatalf("limiter len after RoundTrip = %d, want 1", got)
+	}
+	if err := resp.Body.Close(); err != nil {
+		t.Fatalf("Body.Close() error = %v", err)
+	}
+	if got := len(limiter); got != 0 {
+		t.Fatalf("limiter len after Body.Close = %d, want 0", got)
+	}
+}
+
+type roundTripperFunc func(*http.Request) (*http.Response, error)
+
+func (f roundTripperFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}
+
 func TestSanitizeProxyRequestHeaderDropsLoginCookie(t *testing.T) {
 	source := http.Header{}
 	source.Set("User-Agent", "browser")