fix(uds-auth): surface real cause of QR login network errors (0.3.16)

The QR poll showed a generic "network error" for any failure, and the
server collapsed every upstream failure into an opaque 502 with no log.

- Classify upstream failures (DNS, timeout, unreachable, TLS cert, HTTP
  status, bad response) and return host-specific localized messages.
- Report why the post-scan user lookup failed instead of a generic
  invalid-credentials error.
- Log the real errno/message server-side for every qr-proxy failure.
- Show the server message in the QR poll UI; keep "network error" only
  for failed local fetches.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

uds-auth/lib/middleware/auth-middleware.js

@@ -55,7 +55,8 @@ export function createAuthMiddleware(config, sessionStore, rolesStore, hooks = {
   ).trim()
   const initialAdminEmpNo = resolveInitialAdmin()
 
-  async function verifyEmpNoAndToken(empNo, token) {
+  /** @param {{ onFailure?: (out: object) => void }} [opts] lets callers surface why the lookup failed */
+  async function verifyEmpNoAndToken(empNo, token, opts = {}) {
     const out = await searchUserByEmpNoToken({
       userSearchUrl,
       empNo,
@@ -66,11 +67,13 @@ export function createAuthMiddleware(config, sessionStore, rolesStore, hooks = {
     })
     if (!out.ok) {
       console.warn('[uds-auth] verifyEmpNoAndToken failed:', out)
+      try { opts.onFailure?.(out) } catch { /* diagnostics only */ }
       return null
     }
     const subject = String(out.profile?.empNo || '').trim()
     if (!subject || subject !== String(empNo).trim()) {
       console.warn('[uds-auth] verifyEmpNoAndToken subject mismatch')
+      try { opts.onFailure?.({ ok: false, reason: 'emp_mismatch' }) } catch { /* diagnostics only */ }
       return null
     }
     return out.profile