Fixes the refresh-token fallback: a rejected refresh token now falls back to re-authenticating with the API key.
_read() maps 401 and 403 to HortosAuthenticationError, which is a sibling of HortosResponseError rather than a subclass, so _bearer() never caught it. A revoked or otherwise rejected refresh token surfaced as an authentication failure even though the API key was still valid.
The existing fallback test only covered a 500 response, which was caught; the 401 path is now covered too.