Fix: Don't tell clients to re-authorise when we failed to validate

[rafaeljusto]

Description

GetBearerInfo collapsed every non-200 from /launchpad/v1/userinfo.json into ErrBearerInfoUnauthorized, so a 500 or 502 was indistinguishable from a rejected token. The middleware turned that into 401 plus WWW-Authenticate, which per RFC 9728 tells the client to discard its token — costing a full re-authorisation, and an MFA prompt where MFA is enabled, over what may have been a momentary upstream failure.

Now split three ways: ErrBearerInfoUnauthorized (401/403 only, still challenges), ErrBearerInfoUnavailable (503, no challenge), ErrBearerInfoCanceled (our request context died because the client hung up — logged at debug, no response written). That last case accounts for the overwhelming majority of these errors in practice: clients closing their stream on GET /, previously reported as server errors of ours.

classifyAuthStatus isolates the status decision; the sweep over 100-599 asserts nothing outside 401/403 can read as a rejection.

Type of Change

• Bug fix
• New feature
• Breaking change
• Documentation update

Testing

• Tests pass locally (go test -v ./...)
• Added/updated tests for new functionality

Checklist

• Code follows project style guidelines
• Self-reviewed the code
• Added necessary documentation
• No new warnings or errors