fix(cli): stop masking auth errors as token expiry

[waveywaves]

Summary

• Fix all 401/UNAUTHORIZED auth errors being incorrectly displayed as "your authentication token has expired"
• Reorder switch cases so isUnmatchedAuthErr fallback does not shadow org-membership error cases
• Add unit tests for isWrappedErr and isUnmatchedAuthErr helper functions

Root Cause Analysis

The Kratos errors.Is() implementation only compares Code and Reason fields:

func (e *Error) Is(err error) bool {
    if se := new(Error); errors.As(err, &se) {
        return se.Code == e.Code && se.Reason == e.Reason
    }
    return false
}

All JWT middleware errors (ErrTokenExpired, ErrTokenInvalid, ErrTokenParseFail, ErrMissingJwtToken) are created with errors.Unauthorized("UNAUTHORIZED", "<message>"), giving them identical Code: 401 and Reason: "UNAUTHORIZED" fields. Only the Message field differs. This caused errors.Is() to match any auth error against ErrTokenExpired first in the switch statement, masking the real error type.

Changes

• Remove the errors.Is() short-circuit in isWrappedErr — keep only the Code + Message comparison, which correctly distinguishes between different JWT error types
• Add explicit case branches for ErrTokenInvalid ("token is invalid") and ErrTokenParseFail ("failed to parse token") so users see accurate error messages
• Add a fallback (isUnmatchedAuthErr) for unmatched 401 errors that surfaces the server's original message instead of silently dropping it
• Reorder switch cases so org-membership checks (IsUserNotMemberOfOrgErrorNotInOrg, IsUserWithNoMembershipErrorNotInOrg) come BEFORE the generic isUnmatchedAuthErr fallback, preventing the fallback from shadowing them
• Add explanatory comment on isWrappedErr documenting why we use Message comparison instead of Kratos errors.Is()
• Add unit tests covering:
  • isWrappedErr correctly matches each JWT error sentinel against itself
  • isWrappedErr does NOT cross-match different JWT error types
  • isUnmatchedAuthErr catches generic 401/Unauthenticated errors
  • isUnmatchedAuthErr does NOT catch non-401 errors (PermissionDenied, Internal, NotFound, OK)
  • Regression test demonstrating the Kratos errors.Is() masking bug and proving our fix avoids it

Test Plan

• go test ./app/cli/ -v — all 15 test cases pass
• go vet ./app/cli/... passes
• Test with an expired JWT token: confirms "token has expired" message
• Test with an invalid/revoked JWT token: confirms "token is invalid" message (previously showed "token has expired")
• Test with a malformed JWT token: confirms "failed to parse" message
• Test with missing JWT token: confirms "authentication required" message
• Test with an unrecognized 401 error: confirms server's original message is shown

Fixes #2922