Complete OtfUser's public error boundary

[jessica-claude]

Description

Follow up on closed issue #138 and released otf-api 0.21.0. The release adds OtfAuthenticationError and OtfTransportError, but _create_cognito() still exposes an incomplete public error boundary: construction-time transport failures are re-raised raw, and translated authentication errors render raw Cognito provider text. Downstream personal-apis migration is waiting for this upstream-only completion; do not change downstream adapters.

Acceptance Criteria

• Constructor/login-time invalid-credential failures raise public OtfAuthenticationError rather than a Cognito/botocore implementation exception.
• str(OtfAuthenticationError) is a fixed, safe public message (for example, OTF authentication failed) and does not include Cognito provider request or detail text; the original exception remains available as __cause__.
• Constructor/login-time connectivity, timeout, and endpoint failures raise public OtfTransportError with a fixed, safe public message rather than raw implementation exceptions.
• Unexpected programming errors during construction or authentication continue propagating unchanged.
• The existing raw constructor-time transport failure behavior no longer occurs.
• Public regression tests cover invalid credentials and a simulated constructor-time transport failure, and the existing test suite passes.

Affected Areas

• src/otf_api/auth/user.py — complete _create_cognito()'s translation boundary and safe public messages.
• src/otf_api/exceptions.py — use the existing public exception types and their documented cause contract.
• tests/test_api/test_errors.py — extend public error-wrapping regression coverage for message safety and constructor-time transport failure.

Context

Issue #138 introduced the public exception classes in 0.21.0, but src/otf_api/auth/user.py catches only botocore.exceptions.ClientError; its generic except Exception logs then re-raises raw. Current tests already cover the ClientError wrapping path, while OtfTransportError tests cover request-time HTTPX failures only. Preserve original exceptions with exception chaining, but make normal public exception rendering stable and safe.