OAuth login fails on headless VPS: "Premature close" fetching oauth2.googleapis.com/token (CLI HTTP stack only)

**Environment:** gemini-cli v0.51.0, Node v22.23.0, Ubuntu 24.04 VPS (Contabo, no proxy), headless via SSH/tmux.

**Bug:** `gemini` login (both browser fallback and NO_BROWSER=true user-code flow) always fails at token exchange with:

```
Invalid response body while trying to fetch https://oauth2.googleapis.com/token: Premature close
```

(FatalAuthenticationError, exitCode 41).

**Evidence it's the bundled HTTP stack, not the network:** on the SAME machine/user, the token endpoint works via curl (HTTP 400 on probe), Python urllib (full manual PKCE exchange succeeded — got access+refresh token), and raw Node fetch (HTTP 400 on probe). Only the CLI bundle fails.

**Tried:** NODE_OPTIONS=--dns-result-order=ipv4first, clean ~/.gemini, fresh flows — same result. Manually written oauth_creds.json is ignored (CLI re-validates via same failing stack and loops back to auth).

**Expected:** token exchange succeeds, or CLI honors valid cached oauth_creds.json.

Reproduce the OAuth token exchange on the headless VPS and compare the CLI's bundled HTTP stack with curl, Python urllib, and raw Node fetch. Trace the CLI authentication request path; done means browser and NO_BROWSER=true flows complete successfully, or a valid cached oauth_creds.json is honored without re-authentication.

Written by the indexing model from the issue text.