fix(web): preserve auth error meaning

[Alex0158]

Summary

• map 401 feedback through the shared API error-code catalog so invalid credentials are not mislabeled as an expired session
• keep EMAIL_NOT_VERIFIED owned by the recoverable Login verification flow without a duplicate transport toast
• record the Production browser finding and exact closure criteria in core governance docs

Verification

• frontend focused: 118 tests passed
• frontend full: 185 files / 2048 tests passed
• frontend lint passed
• frontend build passed
• docs:check passed
• web:a11y:contracts passed
• web:product-lines:check passed
• web:admin-boundary:check passed