fix(uds-auth): surface real cause of QR login network errors (0.3.16)

The QR poll showed a generic "network error" for any failure, and the
server collapsed every upstream failure into an opaque 502 with no log.

- Classify upstream failures (DNS, timeout, unreachable, TLS cert, HTTP
  status, bad response) and return host-specific localized messages.
- Report why the post-scan user lookup failed instead of a generic
  invalid-credentials error.
- Log the real errno/message server-side for every qr-proxy failure.
- Show the server message in the QR poll UI; keep "network error" only
  for failed local fetches.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

uds-auth/lib/i18n.js

@@ -131,6 +131,16 @@ export const MESSAGES = {
     'err.qr_expired': '二维码已过期',
     'err.qr_mismatch': '二维码校验失败',
     'err.upstream_too_large': '上游响应过大',
+    'err.upstream_dns': '无法解析 {host}（DNS 失败），请确认本机已接入公司内网 / VPN',
+    'err.upstream_timeout': '连接 {host} 超时，请确认本机已接入公司内网 / VPN，且未被防火墙拦截',
+    'err.upstream_unreachable': '无法连接 {host}（连接被拒绝或中断），请检查网络、防火墙与代理',
+    'err.upstream_cert': '与 {host} 的 TLS 证书校验失败：Node 不读取系统证书库，请设置 NODE_OPTIONS=--use-system-ca 或 NODE_EXTRA_CA_CERTS 后重启',
+    'err.upstream_error': '访问 {host} 失败，详见服务端日志',
+    'err.upstream_http_status': '{host} 返回 HTTP {status}',
+    'err.invalid_upstream_response': '{host} 返回了无法识别的响应',
+    'err.profile_http_status': '用户信息服务 {host} 返回 HTTP {status}（该服务需内网直连，不能经代理）',
+    'err.profile_rejected': '扫码成功，但用户信息校验未通过（{reason}）',
+    'err.login_finalize_failed': '扫码成功，但本机创建会话失败（{detail}），详见服务端日志',
     'err.config_not_ready': '配置未初始化',
     'err.request_failed': '请求失败',
     'err.method_not_allowed': '方法不允许',
@@ -313,6 +323,16 @@ export const MESSAGES = {
     'err.qr_expired': 'QR challenge expired',
     'err.qr_mismatch': 'QR challenge mismatch',
     'err.upstream_too_large': 'Upstream response too large',
+    'err.upstream_dns': 'Cannot resolve {host} (DNS failed). Make sure this machine is on the corporate network / VPN',
+    'err.upstream_timeout': 'Connection to {host} timed out. Make sure this machine is on the corporate network / VPN and not firewalled',
+    'err.upstream_unreachable': 'Cannot connect to {host} (refused or reset). Check network, firewall and proxy',
+    'err.upstream_cert': 'TLS certificate check for {host} failed. Node ignores the OS cert store: set NODE_OPTIONS=--use-system-ca or NODE_EXTRA_CA_CERTS and restart',
+    'err.upstream_error': 'Request to {host} failed; see server logs',
+    'err.upstream_http_status': '{host} returned HTTP {status}',
+    'err.invalid_upstream_response': '{host} returned an unrecognized response',
+    'err.profile_http_status': 'User lookup service {host} returned HTTP {status} (needs direct intranet access, no proxy)',
+    'err.profile_rejected': 'Scan succeeded but user lookup was rejected ({reason})',
+    'err.login_finalize_failed': 'Scan succeeded but creating the local session failed ({detail}); see server logs',
     'err.config_not_ready': 'Config not initialized',
     'err.request_failed': 'Request failed',
     'err.method_not_allowed': 'Method not allowed',