fix: show distinct gateway-auth-rejected message and stop misrouting 'token' errors (#239)

[Sanjays2402]

Summary

Fixes the wrong UI message when the gateway refuses a device's auth token (the user-visible string is "Hermes Agent rejected the connection token").

Two related bugs in src/lib/connection-errors.ts:

1. Dead-code case fallthrough

getConnectionErrorMessage had a duplicate case 'clawsuite_auth_required': label sitting between case 'gateway_auth_rejected': and its body:

case 'gateway_auth_rejected':
case 'clawsuite_auth_required':   // ← unreachable; already handled above
  return {
    title: 'Claude Login Required',
    description: 'This instance requires a password to access.',
    action: 'Enter your password to continue',
  }

Because clawsuite_auth_required is handled by the previous arm, every gateway_auth_rejected ended up rendering the ClawSuite "Login Required / Enter your password" UI — which is the wrong remedy when the actual problem is the gateway refusing the device token. (No password to enter — you need to re-pair / fix the gateway token.)

2. Over-broad 'token' heuristic in classifyConnectionError

lower.includes('token') ||  // matches anything containing the word "token"

Any error whose message merely contained the substring token (including benign network errors like failed to fetch token from /api/foo, cancellation token, etc.) got classified as gateway_auth_rejected, which compounded bug #1 by sending the user to a "log in again" prompt.

Fix

• Give gateway_auth_rejected its own dedicated message that tells the user the gateway refused the device's token and points them at re-pairing / checking the gateway token (not at typing a password).
• Tighten the heuristic: 'token' is now a hit only when paired with an auth-failure marker (unauthorized, forbidden, rejected, invalid, expired, missing, 401, 403, …). Bare 'token' strings fall through to the network/unknown bucket as before.

The two fixes work together — the heuristic stops over-matching, and even when gateway_auth_rejected does legitimately fire, the user now sees an accurate message.

Tests

Added src/lib/connection-errors.test.ts with 17 specs covering:

• Original behavior for HTTP 401/403, pairing, network, handshake, timeout, disconnect, unknown.
• Regression test for issue Hermes Gateway chat works but enhanced calls show 'Hermes Agent rejected the connection token' #239: the literal error string "Hermes Agent rejected the connection token" must classify to gateway_auth_rejected, and getConnectionErrorMessage('gateway_auth_rejected') must return a different title/description than clawsuite_auth_required and must not tell the user to enter a password.
• Regression test for the heuristic: "failed to fetch token from /api/foo" must classify to gateway_unreachable, not gateway_auth_rejected.
• Each ConnectionErrorKind returns a non-empty title and description.

$ pnpm vitest run src/lib/connection-errors.test.ts
 ✓ src/lib/connection-errors.test.ts (17 tests) 2ms
 Test Files  1 passed (1)
      Tests  17 passed (17)

Full suite before fix: 19 failed | 172 passed. After fix: 19 failed | 189 passed — same pre-existing failures (in markdown.test, chat-message-list.test, -models.test, -servers.test), no regressions, +17 new passing tests.

Fixes #239