fix(xcecli): friendly message for connection-refused instead of raw OS error (bug-1675, gitea #42)

ExtractErrorMessage()'s connection-refused branch returned the bare
OS error string verbatim. A CLI call right after apiserver startup
(before its listener is up) surfaced a raw "get the request failed:
[connection refused]" with no indication it's a transient startup
race, not a real failure.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01AgYRU3zDTqNGV5Jk8aiKLg

src/frontend/xcecli/common/request/request.go

@@ -184,7 +184,7 @@ func ExtractErrorMessage(err error) string {
 
 	//Handle connection refused errors
 	if strings.Contains(errStr, "connection refused") {
-		return "connection refused"
+		return "cannot reach the API server -- it may still be starting up, retry shortly"
 	}
 
 	// Handle timeout errors

src/frontend/xcecli/common/request/request_test.go

@@ -1,6 +1,46 @@
 package request
 
-import "testing"
+import (
+	"errors"
+	"testing"
+)
+
+func TestExtractErrorMessage(t *testing.T) {
+	tests := []struct {
+		name string
+		err  error
+		want string
+	}{
+		{
+			name: "connection refused is friendly, not raw",
+			err:  errors.New("dial tcp 127.0.0.1:8080: connect: connection refused"),
+			want: "cannot reach the API server -- it may still be starting up, retry shortly",
+		},
+		{
+			name: "timeout",
+			err:  errors.New("context deadline exceeded (Client.Timeout exceeded while awaiting headers): timeout"),
+			want: "connection timeout",
+		},
+		{
+			name: "network unreachable",
+			err:  errors.New("dial tcp: network unreachable"),
+			want: "network unreachable",
+		},
+		{
+			name: "dns not found",
+			err:  errors.New("dial tcp: lookup badhost: no such host"),
+			want: "host not found",
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			got := ExtractErrorMessage(tt.err)
+			if got != tt.want {
+				t.Errorf("ExtractErrorMessage(%q) = %q, want %q", tt.err, got, tt.want)
+			}
+		})
+	}
+}
 
 func TestAuthHeaderConsistency(t *testing.T) {
 	token := "test-token-abc"