fix(cli): classify wrapped SDK HTTP errors correctly

[LeonSGP43]

Description

When an automatic token refresh is rejected with HTTP 401 or 403, net/http and SDK contextual wrapping hide the HTTP prefix from the CLI classifier. The command reports network.error / exit 7 instead of an auth error / exit 3. Locate sdk.APIError through the error chain before applying the existing status classification and known server-not-found rescue. Keep the legacy string fallback for other callers.

Type of Change

• 🐛 Bug fix

Related Issue

No linked issue. Reproduced locally on the current target branch.

Testing

Regression tests use the real SDK, production AuthRetryTransport and RefreshAndPersist, and a task-private FileStore against HTTP fixtures. An initial document 401 triggers a refresh rejected with 401 or 403; the fixed result retains auth classification and exit 3. Both regressions fail on the target branch. The cmdutil and acceptance contract suites pass. Missing refresh-token errors without an APIError are outside this change.

Go 1.26.8 on macOS arm64: CLI go test -race -count=1 -coverprofile=../auth_wrapped-coverage.out -json ./... passes 1187 tests/subtests in 19.571s. golangci-lint run --new-from-rev=origin/main ./... (official v2.12.2), go vet ./..., go build ./..., skill-wire vocabulary and secret-token checks, and git diff --check origin/main...HEAD all pass with exit 0.

Windows/Linux runtime and unrelated backend/frontend checks were not run. The client module is unchanged.

Checklist

• git diff --check origin/main...HEAD passes
• Changed source files are formatted
• Targeted tests for the changed packages/components pass
• Diff-scoped lint passes where applicable
• Full-repository checks were run, or any unrelated/environment-dependent failures are documented above
• Self-reviewed the code
• Added/updated tests covering the change
• Updated related documentation
• Breaking changes are clearly called out in the description above

Implemented with assistance from gpt-6.1-sol; the final diff was reviewed locally.