feat(platform): give AuthState::LoginFailed a typed kind

[filvecchiato]

Closes #390.

• LoginFailed { kind, reason } with LoginFailureKind::{NoFreeAllowanceSlots, Other}. Hosts branch on kind and use reason as display copy.
• The wallet reports refusals as prose over EncryptedResponse::Failed(String), so the core recovers the discriminant once in runtime/login_failure.rs instead of leaving every host to regex it.
• That text comes from this workspace's own SlotError Display impls, and the tests classify straight from them — rewording one now fails CI here rather than silently turning a host's fast-fail into a retry loop.

Typing the inter-host wire itself is a follow-up: it needs a coordinated wallet rollout, and kind means hosts won't need a second API change when it lands.

[Imod7]

rust/crates/truapi-host-cli/src/main.rs line 1170 already does this classification:

err.to_string().contains("no free StatementStore slot")

With the new classify_login_failure, the same fact lives in two crates under two different rules, and the CLI copy is the weaker one: case-sensitive, and no long-term-storage marker. It is load-bearing, prepare_pairing_response uses it to rotate an exhausted auto-managed account. Could you move the markers plus one predicate into rust/crates/truapi-server/src/runtime/statement_allowance/slot.rs, next to the SlotError Display strings they mirror, and call it from both places. I tried it: pub fn reports_exhausted_period(text: &str) -> bool there, classify_login_failure as a wrapper, and the CLI calling truapi_server::statement_allowance::slot::reports_exhausted_period(&err.to_string()). It compiles and the new tests stay green.

[filvecchiato]

On the duplicated classification in truapi-host-cli/src/main.rs — done, along the lines you suggested.

reports_exhausted_period(text: &str) -> bool now lives in rust/crates/truapi-server/src/runtime/statement_allowance/slot.rs, beside the SlotError Display strings it mirrors. classify_login_failure is a wrapper over it, and is_statement_slot_exhaustion calls truapi_server::statement_allowance::slot::reports_exhausted_period(&err.to_string()). The CLI picks up both things its own copy was missing: case-insensitivity and the long-term-storage rendering.

register_pairing_allowances only reaches register_statement_account, so NoFreePgasSlot is not reachable from that call site and the widening does not change which failures rotate an auto-managed account. FreeSlotsAwaitingSubmission still reads false, which is what keeps a pass from replacing a slot that is about to free up.

Added an_exhausted_period_is_reported_whatever_wraps_it in slot.rs, covering the rotation-relevant shape: the raw SlotError, the same error wrapped in the CLI’s "allowance registration for {label} failed: {e}" context, the long-term-storage variant, and FreeSlotsAwaitingSubmission staying false. The classifier tests in login_failure.rs are unchanged and green.