Auth prompt is triggered for non-auth provider errors (after #184)

[TyceHerrman]

In #184, the summary says:

“When a provider fails to retrieve a secret (typically due to expired credentials), fnox now prompts users to run the appropriate auth command…”

While testing adding Proton Pass as provider:

• Provider: Proton Pass (auth_command = "pass-cli login --interactive").
• Secret reference defaults to /password.
• Item existed but had no password field (alias/email-only item).
• Provider failure was non-auth (Field does not exist: password / secret-not-found class).
• fnox still printed Authentication failed for provider ... and prompted login.

Potential issue in current flow:

• In secret_resolver, auth prompt/retry is called on any provider error.
• prompt_and_run_auth checks whether prompting is enabled and whether the provider has an auth_command, but does not check if the error itself is auth-related.

Proposed fix:

1. Gate auth prompting/retry to auth-class errors only (for example ProviderAuthFailed), instead of all provider errors.
2. Ensure providers map known non-auth failures to non-auth variants (for Proton Pass, map Field does not exist to ProviderSecretNotFound with a field-specific hint).
3. Keep current auth-retry behavior unchanged for true auth failures.

[jdx]

sounds good to me

[ulisses-cruz]

@jdx ,in #184, says:

• Adds auth_command field to all provider definitions with sensible defaults (e.g., aws sso login, op signin)

Could the field be exposed through the fnox.toml config file, so it could be overridden, like this?

[providers]
rbw = { type = "bitwaden", backend = "rbw", auth_command = "rbw unlock" }

The reason I'm asking is because, the bitwarden provider uses as auth_command:

bw login

but because I'm using the rbw backend I need to change it to:

rbw unlock

[TyceHerrman]

closed by #297. follow up comment closed by #305