0.3.16 mapped every post-scan failure to login_finalize_failed, hiding
codes with their own message (bootstrap_required, account_disabled,
registration_closed). Pass those through again and only fall back for
unknown errors.
The bootstrap_required message now includes the scanned employee number
and how to proceed (UDS_AUTH_INITIAL_ADMIN or emergency account login).
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
The QR poll showed a generic "network error" for any failure, and the
server collapsed every upstream failure into an opaque 502 with no log.
- Classify upstream failures (DNS, timeout, unreachable, TLS cert, HTTP
status, bad response) and return host-specific localized messages.
- Report why the post-scan user lookup failed instead of a generic
invalid-credentials error.
- Log the real errno/message server-side for every qr-proxy failure.
- Show the server message in the QR poll UI; keep "network error" only
for failed local fetches.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
