refactor(embedded): replace boolean accessors with typed EmbeddedAuthError

[pmathew92]

Description

Refactors EmbeddedAuthException to classify failures through a single strongly-typed EmbeddedAuthError sealed interface (EmbeddedAuthException.error), replacing the eight boolean is* accessors and the top-level nextActions field.

What changed

• New public type EmbeddedAuthError — sealed interface, 10 variants: InsufficientAuthorization(nextActions) (data class) plus data objects TooManyWrongOtpAttempts, ChallengeExpired, AccessDenied, TooManyAttempts, TooManyLogins, SessionExpired, Network, NoActiveSession, Unknown.
• EmbeddedAuthException — exposes error; removed the 8 is* accessors and moved nextActions onto InsufficientAuthorization (only the recoverable case carries next steps).
• Centralised classification in a single embeddedAuthErrorAdapter() mapping (statusCode, code, description, cause) → EmbeddedAuthError. All invalid_grant maps to SessionExpired (no phase split).
• Session lifecycle (updateSessionFromFailure) — InsufficientAuthorization adopts the rotated auth_session; Network preserves the session for an in-place retry; every other error clears it, forcing a fresh authorize(). (Token-exchange failures continue to leave the session intact via AdvancingRequest, independent of this rule.)

Checklist

• Unit tests for success and error paths
• Callback + coroutine (await) parity covered
• Explicit visibility / return types (explicit-API mode)

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Advanced

Run ID: f4bca7e0-c0f5-445a-bfa2-f6556f6773d8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Autopilot is currently an internal CodeRabbit preview.

---

_{Comment @coderabbitai help to get the list of available commands.}

[utkrishtsahu]

approved

[NandanPrabhu]

"invalid_identifier_or_code" "invalid_code" "authorization_pending" "slow_down" "invalid_identifier_or_password" enums that can come under insufficient authorization. do we need add all these?

[pmathew92]

Not now. We can add when those scenarios come in the next milestones