fix(desktop): only treat real 401/403 as OAuth session expiry

[33hodl]

Summary

Previously, any failure during POST /api/auth/ws-ticket (including timeouts, 5xx, and transient network errors) was wrapped as a GatewayReauthRequiredError and surfaced to the user as:

"Your remote gateway session has expired. Open Settings → Gateway and click 'Sign in' again."

This caused false-positive "session expired" messages on healthy but occasionally slow remote OAuth gateways.

Root cause

resolveGatewayWsUrl, resolveTestWsUrl, and buildRemoteConnection treated every ticket-mint error as an auth failure, without distinguishing real auth failures (401/403) from transport/runtime failures (timeouts, 5xx, connection resets).

Fix

Introduced two small helpers:

• isGatewayAuthFailure (shared)
• isOauthSessionAuthFailure (electron)

These only match actual auth failures (statusCode 401/403 or equivalent message patterns). Non-auth failures now propagate unchanged.

Verification

• node --check apps/desktop/electron/main.cjs
• node --check apps/desktop/electron/connection-config.cjs
• node --test apps/desktop/electron/connection-config.test.cjs → 52 passed
• cd apps/desktop && npx vitest run src/lib/gateway-ws-url.test.ts → 13 passed

Impact

• Real expired/revoked sessions still correctly prompt re-login.
• Timeouts and gateway health issues now surface as connectivity problems instead of misleading reauth prompts.

[teknium1]

Thanks for isolating the false-positive reauthentication path and adding focused tests.

Problems

• Current Desktop guidance intentionally defines an OAuth WebSocket-ticket mint failure as reauthentication-required (apps/desktop/AGENTS.md:127-130). The current shared reconnect resolver preserves that behavior at apps/shared/src/websocket-url.ts:45-51; Electron boot and the connection test path do the same at apps/desktop/electron/main.ts:6014-6023 and apps/desktop/electron/connection-config.ts:128-138.
• The patch targets CJS Electron files that no longer exist on current main; the corresponding implementation is now TypeScript (39d09453f, feat(desktop): ts-ify everything).

Suggested changes

• Please obtain maintainer direction on changing the documented mint-failure contract before porting this. If approved, rework it against the current TypeScript paths while retaining the no-stale-ticket fallback invariant.

Automated hermes-sweeper review.

[33hodl]

Closing this superseded OAuth-classification PR in favor of the consolidated, rebased implementation in #64673: #64673. The consolidated PR includes the 401/403-only auth classification, bounded transport retry, fresh ticket resolution, session recovery, and the updated Desktop guidance.