[BUG] 5xx upstream responses never trigger failover retry (no error emitted)

- severity: Medium
- files: `shenyu-plugin/shenyu-plugin-httpclient/src/main/java/org/apache/shenyu/plugin/httpclient/WebClientPlugin.java:89`; `.../NettyHttpClientPlugin.java:89-120`; `.../DefaultRetryStrategy.java:105`
- description: `WebClientPlugin` installs `.onRawStatus(httpStatus -> httpStatus >= 400, clientResponse -> Mono.empty())`, so 4xx/5xx produce a completed response with no exception. Failover (`RetryEnum.FAILOVER`) is driven by `onErrorResume`; a 502/503/504 from an unhealthy-but-connected upstream emits no error, so failover never invokes — the bad status is passed straight through.
- impact: Operators relying on `retryStrategy=failover` get no failover for the most common unhealthy-upstream signal (5xx).
- suggested_fix: Optionally map configurable status codes (502/503/504) to errors before the retry strategy.
- confidence: Low-Medium
- related_existing: none — #4280 is a specific HTTPS bug, not the 5xx-no-error gap.

---
_Identified during the 2026-08-02 deep re-scan; full list in [`docs/scan2-2026-08-02/06-medium-tiers.md`](docs/scan2-2026-08-02/06-medium-tiers.md)._

Start with WebClientPlugin.java:89, NettyHttpClientPlugin.java:89-120, and DefaultRetryStrategy.java:105; trace how onRawStatus and onErrorResume interact for upstream 5xx responses. Done means the intended configurable 5xx statuses produce the error path that invokes FAILOVER retry, while other responses retain their current behavior.

Written by the indexing model from the issue text.