chore: switch JSON to encoding/json/v2

[acoshift]

Migrate the shared API types and HTTP client from encoding/json to encoding/json/v2 (Go 1.27).

Why the tag changes

v2 redefines omitempty to mean “omit if this would encode as empty JSON” (null, "", [], {}), not “omit if the Go value is zero”. A naive import swap would have broken the public wire:

• Location feature flags (disk/waf/cache/transform as non-nil *struct{}) encode as {}. v2 omitempty would drop them, so the console’s loc.features.disk gates would treat every location as unsupported. Those fields (and other bool/number/pointer/time fields whose zero value means “absent”) now use omitzero, which is the v1-equivalent “omit Go zero” and is supported by both packages.
• Optional ints such as dropbox minSize/ttl (0 = server default) would have been sent as 0 instead of omitted.
• Zero time.Time (certPendingSince, DNS verifiedAt) never omitted under v1 omitempty (structs are not “empty”). omitzero actually omits them, which matches the console’s optional-string types and avoids year-1 timestamps.

String/slice/map omitempty is unchanged between v1 and v2 and is left as-is.

Other v2 semantics (intentional)

• Nil slices/maps marshal as []/{} rather than null. The console already uses items ?? [].
• Site release manifests pass json.Deterministic(true) so the files object’s key order stays stable for sha256 (v2 maps are otherwise non-deterministic).
• Field matching on unmarshal is case-sensitive. Our tags are the wire names the client sends.
• Duplicate object names and invalid UTF-8 now error instead of being accepted.

Request decode on the apiserver is still arpc’s v1 decoder (separate PR). This PR only changes the api module.

Tests

• Location features still marshal as {"disk":{},...} when enabled and {} when absent.
• Zero times omitted; enum round-trip; nil list items as []; email address string/object forms.
• Dropbox optional ints omitted; site manifest marshal is deterministic.

---

Requested via Grok Work
Prompter: ACS