Classify CLI auth rejects instead of reporting them as prompt timeouts.

Detect Permission denied in hop login and session logs for config sync and WebCRT.

Co-authored-by: Cursor <cursoragent@cursor.com>

netx_api/webcrt_service.py

@@ -612,7 +612,10 @@ def create_session(
             error=str(exc)[:500],
             transcript_len=len(partial),
         )
-        detail = f"connect_failed:{exc}"
+        from .ne_cli_errors import format_cli_failure
+
+        classified = format_cli_failure(exc, partial)
+        detail = f"connect_failed:{classified}"
         if partial:
             # Keep detail bounded; UI surfaces this on open failure.
             detail = f"{detail}\n--- device transcript ---\n{partial[-4000:]}"