fix(uds-auth): surface real cause of QR login network errors (0.3.16)

The QR poll showed a generic "network error" for any failure, and the
server collapsed every upstream failure into an opaque 502 with no log.

- Classify upstream failures (DNS, timeout, unreachable, TLS cert, HTTP
  status, bad response) and return host-specific localized messages.
- Report why the post-scan user lookup failed instead of a generic
  invalid-credentials error.
- Log the real errno/message server-side for every qr-proxy failure.
- Show the server message in the QR poll UI; keep "network error" only
  for failed local fetches.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

uds-auth/lib/uds/user-search.js

@@ -122,7 +122,9 @@ export async function searchUserByEmpNoToken({
   try {
     res = await directRequest(userSearchUrl, { method: 'POST', headers, body, timeoutMs })
   } catch (err) {
-    return { ok: false, reason: 'network', error: err.message }
+    let host = ''
+    try { host = new URL(userSearchUrl).hostname } catch { /* diagnostics only */ }
+    return { ok: false, reason: 'network', error: err.message, code: err.code, host }
   }
 
   // Only accept 2xx — do not treat HTTP 500 + biz success as ok (SEC-16).