test(supplier): lock HTTP-200-without-Content-Type contract (no login-detect false-positive)

app/tests/Unit/Supplier/SupplierPortalClientTest.php

@@ -275,3 +275,14 @@ test('JSON response with substring "loginform-username" is NOT misclassified as
     expect($result)->toHaveCount(1);
     Http::assertSentCount(1);  // no retry — JSON header skips login-detect
 });
+
+test('200 response without Content-Type header is NOT detected as login page', function (): void {
+    // Документирует контракт: пустой Content-Type → str_starts_with('','text/html') === false → детект пропускается.
+    Http::fake([
+        'crm.bp-gr.ru/*' => Http::response('{"projects":[]}', 200),  // no Content-Type header
+    ]);
+
+    app(SupplierPortalClient::class)->listProjects();
+
+    Http::assertSentCount(1);  // no retry — empty Content-Type fails the text/html gate
+});