core: fix HTTP exception handling order to prevent NamedError from masking HTTP exceptions

docs: add OPENCODE_PASSWORD environment variable documentation for basic auth