Fix PostgreSQL authentication failure logging

[jokrasno]

Description of Changes

Closes #5696.

• Stop passing the supplied PostgreSQL password/token to authentication logging.
• Categorize token validation failures as invalid credentials, identity-provider failures, or unexpected internal failures.
• Log invalid credentials at WARN and provider/internal failures at ERROR with distinct messages.
• Add captured-log tests proving a synthetic supplied token is absent from messages/targets and each category uses the intended level.

API and ABI breaking changes

No wire API or ABI changes. TokenValidationError gains typed variants and an operational category API; downstream Rust code that exhaustively matches this public enum may require a source update.

Expected complexity level and risk

2. The PostgreSQL change is narrow, but the classification is defined at the token-validation source so logging does not rely on error text. The client-visible authentication response remains unchanged.

Testing

• cargo fmt --all -- --check
• Exact external red/green logging harness: 2 expected failures before; 3/3 passing after
• cargo test -p spacetimedb-pg -- --test-threads=1 (6/6)
• cargo test -p spacetimedb-core -p spacetimedb-client-api -- --test-threads=1 (151/151 core, 50/50 client-api, runnable doctests pass)
• cargo clippy -p spacetimedb-core -p spacetimedb-client-api -p spacetimedb-pg --all-targets --no-deps -- -D warnings

The dependency-inclusive Windows Clippy invocation is blocked by an unrelated existing unused binding in crates/snapshot/src/lib.rs:1577; no unrelated fix is included.

[CLAassistant]

All committers have signed the CLA.